<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Access Governance — API Reference

## Audit Access Permissions

```bash
node scripts/agent.js --action audit --input /tmp/access_matrix.json --policy /tmp/rbac_policy.json
```

## Detect Orphaned Access

```bash
node scripts/agent.js --action orphans --input /tmp/access_matrix.json --active-users /tmp/active_users.json
```

## Generate Access Certification

```bash
node scripts/agent.js --action certify --input /tmp/access_matrix.json
```

## Access Matrix Input Format

```json
{
  "access": [
    {"user": "jdoe", "role": "analyst", "permissions": ["read", "export"], "manager": "msmith"},
    {"user": "admin1", "role": "dba", "permissions": ["read", "write", "admin"], "manager": "cjones"}
  ]
}
```

## RBAC Policy Input Format

```json
{
  "role_permissions": {
    "analyst": ["read"],
    "engineer": ["read", "write"],
    "dba": ["read", "write", "admin"]
  }
}
```

## Audit Output Format

```json
{
  "user": "jdoe",
  "role": "analyst",
  "excess_permissions": ["export"],
  "severity": "high"
}
```

## Orphan Detection Output

```json
{
  "user": "former_employee",
  "role": "engineer",
  "permissions": ["read", "write"],
  "action": "revoke_immediately"
}
```
