What problem does it solve? Elevated access granted during a work session often lingers after the task ends, creating unnecessary security exposure. This Skill audits permissions granted during the current or resumed session, revokes temporary grants, and verifies removal before the session closes. ## Core Features & Use Cases - Session Grant Discovery: Lists every IAM role, API scope, bucket binding, or equivalent elevated access granted during the session, with principal, resource, and reason. - Temporary vs Standing Classification: Distinguishes one-off investigation or debugging access from access required by documented recurring workstreams. - Verified Revocation: Revokes temporary grants with the narrowest available command, then re-queries the principal and resource to confirm removal. - Use Case: After a debugging session where you granted a service account temporary bucket read access, run this audit before closing the session to revoke the binding, verify it is gone, and produce a per-grant report. ## Quick Start Use origin-permission-audit to audit and revoke any elevated access granted during this session before closing it.
