EXTENSIONS

Datadog Teams — team management, memberships, and permissions

Kubernetes operational toolkit — 16 model types covering pods, deployments, statefulsets, services, RBAC, storage, networking, autoscaling, batch jobs, and more. Includes 14 ready-to-run workflows for namespace debugging, security audits, RBAC analysis, cluster health, and operational diagnostics.

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Datadog RBAC — role, permission, user, and restriction query analysis via the Datadog RBAC API (v2). Answers "who can access what data?" by resolving the full chain: user → roles → permissions + restriction queries → effective access. Supports all Datadog sites (us1, us3, us5, eu1, ap1, us1-fed).

Manage FreeIPA sudo, HBAC, RBAC, privilege, and CA-ACL policy over the JSON-RPC API: find/show read-only snapshots plus idempotent ensureSudoRule/ensureHbacRule/ensureRole/ensurePrivilege/ensureCaAcl, fan-out member/option/privilege/permission/certprofile methods, enable/disable toggles, read-only privilege/permission/CA-ACL discovery, and confirm-guarded deletes, each mutation with an audit trail.

Control-plane administration of a Garage (S3-compatible object store) cluster via its Admin API v2 (bearer token). Read/audit of cluster health, buckets, access keys, and the full key×bucket permission matrix; plus management — create /update/delete buckets, manage aliases, create/import/update/rotate/delete access keys, and grant/revoke read/write/owner permissions. Never touches S3 object data; destructive verbs verify the target by id first.

Non-destructive PostgreSQL administration over a direct TCP connection (node-postgres). Read/audit of databases, roles, permissions, tables, connections, and extensions; plus data-safe admin DDL — create database/role, grant/revoke, rotate passwords, and an idempotent app_provision composite. Never reads or writes table rows; never DROP/TRUNCATE; no arbitrary-SQL passthrough.