Key capabilities
- Resolve Role and ClusterRole grants across binding scopes
- Match verb, API group, resource, subresource, name, URL and namespace
- Flag wildcard, Secret, exec, impersonate, bind and escalate privileges
- Generate a reviewable least-privilege role draft for the tested request
