You must withdraw broker grants nobody uses, but the audit trail records only refusals. How do you establish use?

## Why this is hard, stated precisely A grant review is the act of reading the grant table against who is actually reading and writing, and withdrawing what nobody uses. Its evidential requirement is positive: to withdraw safely you must establish **use**, and a refusal-only trail records only failure. The absence of a refusal for a principal is equally consistent with two opposite worlds — the grant is exercised thousands of times a minute, or the principal was decommissioned last year — and no amount of care in reading the trail separates them. Everything below is a way to manufacture the positive evidence the trail does not hold, or to restructure the problem so you do not need it. ## Four sources of positive evidence, cheapest first - **Connection records.** Almost every cluster that records anything records connections. A principal that has not opened a connection in a year needs no grants, whatever the grant table says. This is coarse — it tells you a principal is alive, not which streams it touched — but it is free and it typically removes a large fraction of the roster before you make a single risky judgement. - **Per-principal activity accounting.** Clusters commonly attribute bytes and operations to a principal for fairness purposes, without writing an audit record per request. That attribution tells you which identities are genuinely busy. It usually does not resolve to a stream, so use it to sort the roster into active and dormant rather than to justify a specific withdrawal. - **A time-boxed measurement window.** Switch on allowed-decision recording for the streams under review, for a stated period, then switch it back. This produces exactly the evidence you lack. Its weakness is the window: a monthly batch, a quarterly close or an annual process will not appear in two weeks, so the window must be chosen against the rhythm of the workloads involved, and anything periodic must be listed in advance rather than discovered by its absence. - **Who is attached as a reader.** The operator can generally see that a stream has readers. Be careful how far you push this: the reader identity visible on the operating surface is not always the principal the grant is written against, so treat it as a hint that leads to a conversation, not as an attribution. ## Inverting the instrument The refusal-only trail is useless as evidence of use and is precisely the right instrument once you start removing grants. After a withdrawal, a refusal appearing for that principal on that stream is a direct, unambiguous statement that the access was needed. The whole review can be run this way, and on estates with no positive recording at all it is the only method that works. It is also a deliberate production break, so it is run like one: 1. **Order by blast radius.** Begin with principals that have not connected at all, then dormant ones, then active principals holding grants they appear not to use. Never begin with the most central service because it is the most cluttered. 2. **Declare a window.** A withdrawal outside a declared window produces an incident with a confusing symptom, because the failure surfaces in a client as a refusal rather than as an outage of anything obvious. 3. **Make restoration cheap and fast.** The grant must be restorable in about a minute by whoever is watching, without an approval step. If restoring takes an hour, the method is not safe to use. 4. **Watch for a stated period, then close.** Periodic workloads are the trap: a grant withdrawn on Tuesday may not be missed until the month-end run. ## The structural repair, which is the actual answer at this level Every technique above is a way of paying for evidence you did not collect. The lasting fix is to change the burden of proof: | Approach | Burden of proof | What it demands of you | |---|---|---| | Review against a refusal-only trail | On the reviewer, to prove a grant is unused | Evidence the cluster never produced | | Review against positive access records | On the reviewer, but the evidence exists | Standing cost of recording, chosen per stream | | Grants that expire | On the owner, to justify renewal | Discipline at grant time, and a renewal path that works | A grant with an end date is reviewed by construction. Nobody has to prove a negative: the grant lapses, and whoever still needs it says so. It converts an archaeological exercise into a routine one, and it is the difference between an estate whose grant table has only ever grown and one that reflects current reality. The cost is real — a renewal path that is slow or manual causes outages at expiry and gets defeated by long expiry dates — so the expiry interval and the renewal mechanism are the design, not the idea itself. ## The honest limit Even with all of this, some access leaves no attributable trace, and evidence is always about the window you observed. A grant review is therefore a risk decision, not a proof. State it that way: **these grants showed no use under this evidence over this period, and were withdrawn with restoration available** — which is defensible, unlike a claim that they were unused.