Run an access sweep
Upload a directory export (Google Workspace, M365, SSO CSV, etc.) and optionally an HR roster. Map columns locally — nothing leaves this machine unless you host it publicly later.
MVP scope
- Rules: MFA off, idle 90d, admin combinations, HR mismatch
- Export: print / save PDF from results page
- No OAuth in this build — CSV only