Public and private resources: Audit and verification
Covers permission test matrices, audit evidence, migration checks, and incident investigation for public and private resources. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.