EXTENSIONS

Good-planning model that operationalizes Felipe Bovolon's "Good Planning

Standalone swamp port of ArcKit (https://github.com/tractorjuice/arc-kit —

Snyk Policies — security policy management and rule configuration

Griptape Cloud Rulesets — behavioral rulesets and their rules

Query and monitor AWS Service Quotas across accounts. Fan-out utilization

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Backstage software catalog reader — query entities, read one entity with its