The intended-access source of truth. It reads what every identity in a cloud account actually holds, records what each was supposed to hold, who approved it, and until when, and shows the difference as a decision someone owns.
The repository is https://github.com/manifest-identity/manifest-identity, formerly role-call, and its documentation is at https://manifest-identity.github.io/manifest-identity/. It is part of control-plane, a security engineering program built in public: https://tltaylor1.github.io.
