Orca Over-Privileged Identity Right-Sizing Skill

Answers the question: "Which of our identities hold far more permission than they use, and how do we safely cut them down?"

Every unused permission is standing attack surface: if the identity is phished or its key leaks, the blast radius is everything it may do, not what it does do. This skill sweeps an account or business unit for identities whose granted permissions exceed their observed usage, ranks them by identity risk score, and walks the user through right-sizing with a non-destructive path (stage: generate the change, apply nothing) and a destructive path (apply) that is always gated behind an evidence-based safety check plus explicit confirmation.

The core signal: Orca's recommendation engine pre-computes a PoLP verdict per identity/grant from ~90 days of observed usage, stored as RecommendationType with exactly three values: "Reduce Permissions" (over-privileged — this skill's target), "Inactive" (dead weight — hand off to /orca-inactive-identities-cleanup), and "PoLP Aligned" (nothing to do). Where the verdict lives differs per provider:

• AWS (identity-level): an AwsEffectivePermissionsPolicy per user/role carries the verdict plus a generated least-privilege policy (Recommendation.recommended_policy), UsedServices vs EntityAuthorizedServices, and the identity's PermissionUsage ratio (share of authorized services actually used). Exposed directly via get_aws_effective_permissions_policy_on_asset. The engine skips IAM groups.
• Azure (grant-level): each AzureIamRoleAssignment carries both the normalized RecommendationType verdict and an inline Recommendation payload: a typed action (detach_role, read_only, just_in_time, scope_reduction, no_action_needed), an action_needed boolean, and read/write action usage with LastUsageTime. The typed actions roll up to the three verdicts (detach_role → "Inactive"; read_only / just_in_time / scope_reduction → "Reduce Permissions"; no_action_needed → "PoLP Aligned"). Computed only where cloud logs are enabled for the subscription.
• GCP (grant-level): a GcpIamPolicyBindingRecommendation per policy binding, same normalized-verdict-plus-typed-payload shape, linked to the user or service account. Feature-flag gated in some tenants.

Provider coverage is a product fact: Alibaba Cloud, OCI, and Tencent Cloud have no PoLP recommendation layer in Orca. This is a three-cloud skill (AWS, Azure, GCP); say so instead of improvising verdicts for other providers.

Usage