[Cenn0]

Roadmap and root cause

P4 directory/SoD reliability. Policy.Plan(GrantAccess) previously validated the requested target and groups present in the current snapshot. If an existing group assignment was omitted from that snapshot, the group was never checked and EffectiveRoleIds treated its effective access as nonexistent. A new role could therefore bypass separation-of-duties calculations even though Keycloak may still enforce the prior group mapping.

UpdateRole also previously resolved existing assigned identities by local ID without a same-realm uniqueness check.

Changes

• Add one indexed, same-realm, fail-closed verification of all existing assignment targets before a new GrantAccess or UpdateRole.
• Reject missing/foreign, duplicated, unknown type/remote ID, stale, incomplete-group and disabled/protected targets with explicit 409 errors.
• Preserve RevokeAccess during directory incidents: do not require this additional visibility gate for entitlement removal.
• Add xUnit tests: hidden SoD group, wrong realm, duplicate, stale, invalid/disabled, role escalation, emergency revoke with missing directory, and allowed complete-snapshot case.
• Update P4 roadmap, test guidance and security handling.

Acceptance

• Require successful .NET build + xUnit + PostgreSQL, ASP.NET API HTTP, live Keycloak/LDAP, worker recovery, OIDC, accessibility, and other applicable PR checks at the exact PR head.
• Fail-closed grant blocking is not a remote Keycloak token revocation or complete Microsoft AD/LDAP validation.
• Investigate and fix CI failures before merge. No production/HA claim.