[M0-D07 follow-up] Collect sample provider access exports for the first reviewed systems

[smiggleworth]

Note

Follow-up discovery issue created 2026-09-22 when M0-D07 #64 closed. This is data gathering for later import work, not a build. Imports and integrations are deferred by product direction on 2026-09-22.

Decision needed

Collect real provider access exports for the first reviewed systems so a later population-import slice can use actual shapes. R2-06a backend #273 first records manually attested snapshots.

Questions to answer

• Collect a sanitized sample export for each first reviewed system: every AWS account (IAM Identity Center users, groups, permission sets and assignments; IAM users and roles), the GitHub organization (members, teams, outside collaborators, apps and tokens), the IdP tenant (admins and privileged roles), and core SaaS admin access (Slack, Jira).
• Confirm, per provider, how nested groups, role assumption, and effective access appear in the export.
• Record ambiguous or shared accounts found in the samples.
• Confirm with the readiness advisor which reviewer-assignment and remediation-verification evidence the auditor accepts.

Involve

Compliance lead, system owners, readiness advisor.

Done when

• Samples are stored as governed test fixtures (sanitized) or described field by field.
• R2-06a's source-shape notes cite them, including the advisor's evidence judgment for manual attestation.
• If provider import is needed, create a separate P1 R2-06 delivery slice with backend and frontend children that cite the validated export shape and depend on EN-05 [EN-05 backend] Import with preview, reconciliation, and safe replay #195; keep manual R2-06a backend [R2-06a backend] Record and accept a point-in-time access population for a reviewed system #273 independent.