What is actually being sold here

Two things, and neither of them is a scan.

A map. Every agent surface a company runs, the credential behind it, and what that credential permits. Then the other half: what each one is actually authorised and expected to do. The gap between the two lists is the product — permitted, and nothing anybody wrote down would need it.

A policy set that would close it. Written against the estate that was just described, one policy per gap, each naming the grant it constrains. Not a template with a company name substituted in.

A named security professional does this work. Nothing in it runs by itself today, the seven-role team these prototypes describe is a specification rather than something staffed, and which parts of it could later be done without people is a decision nobody has taken. {{claim:lab-fulfilment-is-people}} So what these pages produce is the brief that team starts from — the thing a first call would otherwise be spent assembling.