Recipe: triage least-privilege drift

Goal: turn the drift result — the gap between what agents may do and what they are observed doing — into decisions, on a cadence, until the diff is quiet.

1. Pull the drift

On a fresh install, accessmap is off. As an administrator, turn it on in Settings > Edition & modules, keeping the other selected modules on. For the CLI, sign in to this engine as an administrator with olivares login, then run olivares modules on accessmap. Wait for each engine restart before continuing; running sessions stop and can be resumed. Otherwise these API calls return 404 module_not_enabled.

curl -ks "$BASE/v1/m/accessmap/drift" \
  -H "Authorization: Bearer $TOKEN" -H "X-Olivares-Tenant: $TENANT" | python3 -m json.tool

(Or in HCL, for review in a PR: the Terraform data source olivares_access_edges with include_drift = true — manage as code.)

The result has three classes, and they are different problems:

Class	Meaning	The question to ask
Unexpected access	observed, but no grant covers it	is this a missing grant, or a real violation?
Unused grant	granted, never observed exercised	why does this permission exist?
Reconciliation pending	observed, but the agent↔identity link is unresolved	an identity problem, not (yet) a security one

2. Triage each class

Unexpected access — read the edge’s honesty axes before acting:

• attribution_tier: firm + coverage_tier: clean is the highest-quality finding you will get: a specific identity touched a specific resource and the store’s own audit classified it. Decide: if legitimate, declare the grant (policy or binding) so the map reflects intent; if not, revoke the underlying access and treat it as an incident.
• approximate attribution means the access happened but the who is a shared credential. Do not burn an investigation on “which agent was it” — the durable fix is per-agent identity, and until then the edge honestly says what it cannot prove.
• An edge resting only on an mcp_annotation hint is not evidence — the hint is untrusted by spec. Corroborate with an observed source before deciding anything.

Unused grants are over-provisioning found for free: each one is a candidate revocation, with the caveat that absence of observation is only meaningful where coverage exists — check the resource’s coverage tier before celebrating (tiered coverage).

Reconciliation pending routes to the identity backlog: wire or fix the roster source that should bind that credential, and the edge resolves on the next pass.

3. Decide, record, re-check

Make the decision where it is governed: declare grants as code (Terraform) or via the governed API, gate the risky direction behind an approval, and let the ledger record who decided what. Then re-pull the drift: reconciled edges drop out of the diff — only genuine gaps remain. That convergence is the whole point; the demo estate shows it in miniature (quickstart).

In the console, the Access map’s Permitted vs observed panel is this recipe rendered live.

Cadence

Drift triage works as a short weekly loop plus an alert path for the high-signal class (firm + clean unexpected writes). Route those findings to your on-call via a notification destination rather than waiting for the weekly pass.