One doc tagged with "dry-run"

Revocation Rehearsal answers 'what breaks if you revoke this access?' before anyone revokes — a deterministic, read-only dry-run that masks a role grant and diffs the resulting access paths against observed execution evidence