The access-change review is one GET

Friday afternoon, the security lead runs one request: GET /api/v1/events?resource_type=proxy_permissions&start_date=2026-08-31. Every permissions document that changed this week across the fleet comes back: which project, which container, which user, when. A second call with resource_type=auth_token lists every token minted or revoked. Add realm_id and the same query answers for one client's realm only. /api/v1/events/stats gives the counts for the slide.

The token doing the review holds event_access and nothing else. It can't open a terminal or touch a container; it can read what the platform recorded about them.

The review used to mean asking each team lead what they changed, and trusting the answer. The platform's event log covers containers, tokens, firewall rules, aliases, pools, and permissions: the whole fleet's state changes, one query per question.

Who widened access last week is a filter on a URL.