Serverless AWS access recertification engine: discover resources by owner tag, collect keep/trim/revoke decisions, and actually enforce them with scoped changes, hash-chained evidence, and rollback. - View it on GitHub