Identity_Access_Review / Inspect group membership, nested roles, entitlement grants, recent IAM changes, ownership, and recommend/remove excessive privilege. · size 20 · threshold 4 · max attempts 3