Access Control Audit

2 probes

Cross-references columns flagged as PII (by Presidio or manual tagging) with Azure RBAC and ACL assignments to identify over-permissioned access. Produces compliance findings suitable for audit export.

Configuration

sources:
  - type: access_audit
    pii_report: output/presidio.compliance.pii_scan.json
    rbac_report: output/azure_rbac.governance.role_assignments.json
    max_readers_pii: 5   # alert if more than N principals can read PII

Probes

Probe	Description
`access_audit.compliance.pii_rbac`	Cross-reference PII columns with RBAC role assignments
`access_audit.compliance.overpermission`	Flag datasets where PII-reader count exceeds threshold

Usage

metapod run "access_audit.compliance.*" --config config.yaml

Output

{
  "probe": "access_audit.compliance.pii_rbac",
  "source": "access_audit",
  "collected_at": "2026-03-31T08:00:00Z",
  "results": [
    {
      "dataset": "customers.csv",
      "pii_columns": ["cf", "email"],
      "principals_with_access": 12,
      "threshold": 5,
      "status": "fail",
      "excess_principals": [
        "user:dev-intern@contoso.com",
        "group:all-readers"
      ]
    }
  ]
}