Offboard and the access review

Properties: IX Attributable, XIII Manage only what you declare
Goal: TODO
Done when: TODO
Restart from: lesson 7 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 25 min

Watch

TODO: video

hands-on self-paced live

Offboard removes a principal’s files and every reference to it in one PR and one apply. Zero references remain.
The quarterly artifact reads the live account, through get-role, list-attached-role-policies and Access Analyzer unused-access findings, and never a satellite’s HCL. So a role a satellite created is in the review whichever repo declared it (decision 42). It lists every principal, what it can reach and what expires.
The read-only queries stay scripts under access/scripts/, which are whocan, expiring and offboard --preview, and the desk’s estate pane calls them. There is no separate Q&A page.

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.