Access Control Audit
====================

**2 probes**

Cross-references columns flagged as PII (by Presidio or manual tagging)
with Azure RBAC and ACL assignments to identify over-permissioned access.
Produces compliance findings suitable for audit export.

Configuration
-------------

.. code-block:: yaml

   sources:
     - type: access_audit
       pii_report: output/presidio.compliance.pii_scan.json
       rbac_report: output/azure_rbac.governance.role_assignments.json
       max_readers_pii: 5   # alert if more than N principals can read PII

Probes
------

.. list-table::
   :header-rows: 1
   :widths: 40 60

   * - Probe
     - Description
   * - ``access_audit.compliance.pii_rbac``
     - Cross-reference PII columns with RBAC role assignments
   * - ``access_audit.compliance.overpermission``
     - Flag datasets where PII-reader count exceeds threshold

Usage
-----

.. code-block:: bash

   metapod run "access_audit.compliance.*" --config config.yaml

Output
------

.. code-block:: json

   {
     "probe": "access_audit.compliance.pii_rbac",
     "source": "access_audit",
     "collected_at": "2026-03-31T08:00:00Z",
     "results": [
       {
         "dataset": "customers.csv",
         "pii_columns": ["cf", "email"],
         "principals_with_access": 12,
         "threshold": 5,
         "status": "fail",
         "excess_principals": [
           "user:dev-intern@contoso.com",
           "group:all-readers"
         ]
       }
     ]
   }