Method 2026-10-06.privilege-conflict.1.
This comparison uses the supplied population and explicit role-pair rules. It does not collect live access, expand inherited roles, resolve identity aliases, evaluate exemptions or change permissions. A result without a detected pair does not establish appropriate access or compliance.
This pack contains complete original parsed assignments and policy rules. Keep it private. No role assignment or source file was changed. Reports summarize the first 100 assignments and 100 conflicts, with each text field abridged after 400 characters. Complete source values, all conflicts, all assignment rows and policy coverage remain in Excel and JSON.
JSON is a parsed-source backup, not an exact file-byte backup. Preserve both unchanged original files separately. Restore them through their source selectors and record the population and policy inputs again. CSV is a spreadsheet-safe review export; JSON and Excel preserve exact text.
Method revision 2026-10-06.privilege-conflict.1.
Identities and roles match exact source text. No trimming, case folding, inheritance expansion or identity-alias matching occurs.
Prohibited pairs are symmetric. Each identity and rule appears once in the conflict list, with every supporting assignment source row.
Known identity-role assignments still participate in conflict detection when their reference is duplicated or missing. Such assignment rows remain unresolved.
Every source row is preserved. Duplicate assignment references and repeated identity-role pairs remain unresolved, including their first occurrence.
Rules with zero matches remain visible. They do not prove that every relevant identity or role was supplied.
This comparison uses the supplied population and explicit role-pair rules. It does not collect live access, expand inherited roles, resolve identity aliases, evaluate exemptions or change permissions. A result without a detected pair does not establish appropriate access or compliance.
