> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/getting-started/access-discovery.md). # Access Discovery Discover unused permissions and enforce least privilege Imagine an IAM role created for a staging service. Over time, it was granted administrator access to production. The staging service was later deprecated, and the role has gone unused for months. Yet its permissions remain active. Now multiply that scenario across hundreds or thousands of identities in your cloud environment. How do you find and fix this kind of unused, overly permissive access at scale? **Access Discovery** helps you identify and remediate standing access across cloud environments. It combines access analytics, usage tracking, and policy-based recommendations to support the least privilege for both human and machine identities. At the core of Access Discovery is the concept of a **principal**, a digital identity with cloud access. This includes IAM users, roles, service accounts, and programmatic credentials. Each principal is assigned one or more policies, which define its permissions, or the specific actions it can perform. Access Discovery helps you assess and reduce access risk by: * Categorizing permissions by privilege level, from low-risk LIST/READ to high-risk Admin/IAM controls * Tracking whether principals are active or dormant * Scoring each principal based on its permissions, resource sensitivity, and usage * Flagging overprivileged principals for targeted remediation With these insights, you can focus on what matters most: removing unused admin access, quarantining inactive accounts, and right-sizing policies without disrupting legitimate workflows. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.apono.io/docs/getting-started/access-discovery.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.