Orca Admin Access Grouping Skill

Answers the question: "How few policies do our admins actually need, and who goes in each one?"

Blanket admin is the grant nobody revisits: whoever needed elevated access got AdministratorAccess / Owner because it beat deciding what they actually needed, and each of them can now reach every action the cloud offers while using a few dozen. Orca's IAM Policy Optimizer has already sorted the admin population into groups by observed behaviour and generated one least-privilege policy per group. This skill reads that, presents it, and drives the swap through a non-destructive path (stage: generate everything, apply nothing) and a destructive path (apply) gated behind an activity replay plus explicit confirmation.

Four facts shape everything below.

One MCP call returns the whole thing. get_recommended_admin_policies is org-wide, uncapped, and complete: every group with every member in a single response. It is the one Orca surface free of the 50-result ceiling that bounds discovery_search and get_asset_by_name, so enumeration here is exhaustive rather than best-effort. Beyond that call, MCP calls are spent only on a bounded drill-down and on gating an apply.

The population is narrower than "everyone with admin". All three providers select on two conditions: the identity is privileged, and it already carries an Orca PoLP recommendation (RecommendationType must exist). An admin Orca has not computed a recommendation for is absent entirely. Never present these counts as a complete admin inventory — they are the admins the optimizer can act on.

Each group's policy is the union of what its members did. So nobody loses an action they used inside the window (the safe half), but every member inherits every other member's actions (the risky half). One person's iam:CreateUser becomes the whole group's. Always show what each member gains, not only what the group loses.

Coverage is a product fact. The artifact exists for AWS, Azure, and GCP only. Alibaba Cloud, OCI, and Tencent Cloud have no admin clustering; say so rather than improvising.

Usage