{
  "Metadata": {
    "SchemaVersion": 1,
    "ToolVersion": "0.2.8",
    "Mode": "Demo",
    "Status": "Complete",
    "StartedUtc": "2026-10-13T16:59:50.0000000Z",
    "CompletedUtc": "2026-10-13T17:00:00.0000000Z",
    "DomainName": "demo.example",
    "DomainSid": "S-1-5-21-111111111-222222222-333333333",
    "ForestRootDomain": "demo.example",
    "Server": "dc01.demo.example (synthetic)",
    "SearchBase": "DC=demo,DC=example",
    "InactiveDays": 90,
    "RequestedGraceDays": 14,
    "EffectiveGraceDays": 14,
    "TimestampSyncDays": 14,
    "TimestampSignalAvailable": true,
    "CandidateCutoffUtc": "2026-07-01T17:00:00.0000000Z",
    "Queries": [
      {
        "Query": "Get-ADDomain (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Get-ADForest (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Domain timestamp interval (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Get-ADUser (synthetic)",
        "Status": "Collected",
        "Count": 8
      },
      {
        "Query": "Get-ADGroup (synthetic)",
        "Status": "Collected",
        "Count": 13
      }
    ],
    "Scope": "One domain; AD user objects and group membership relationships only. Not effective authorization, a forest audit, or historical evidence."
  },
  "Accounts": [
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1200",
      "ObjectGuid": "00000000-0000-0000-0000-000000001200",
      "SamAccountName": "alex.admin",
      "Name": "Alex Rivera",
      "UserPrincipalName": "alex.admin@demo.example",
      "State": "Enabled",
      "Email": "alex.admin@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Alex Rivera,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
      "ActivityIndicator": "Within review window",
      "InactivityCandidate": false,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 1,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "Domain Admins",
      "GroupCount": 3,
      "ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1201",
      "ObjectGuid": "00000000-0000-0000-0000-000000001201",
      "SamAccountName": "blair",
      "Name": "Blair Chen",
      "UserPrincipalName": "blair@demo.example",
      "State": "Enabled",
      "Email": "blair@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Blair Chen,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
      "ActivityIndicator": "Within review window",
      "InactivityCandidate": false,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 2,
      "ReviewFlags": "",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1202",
      "ObjectGuid": "00000000-0000-0000-0000-000000001202",
      "SamAccountName": "casey.old",
      "Name": "Casey Morgan",
      "UserPrincipalName": "casey.old@demo.example",
      "State": "Enabled",
      "Email": "casey.old@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Casey Morgan,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-05-16T17:00:00.0000000Z",
      "ActivityIndicator": "Old replicated timestamp",
      "InactivityCandidate": true,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 1,
      "ReviewFlags": "Inactivity review candidate",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1203",
      "ObjectGuid": "00000000-0000-0000-0000-000000001203",
      "SamAccountName": "devon.new",
      "Name": "Devon Patel",
      "UserPrincipalName": "devon.new@demo.example",
      "State": "Enabled",
      "Email": "devon.new@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Devon Patel,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2026-10-05T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "",
      "ActivityIndicator": "No recorded logon; recent account",
      "InactivityCandidate": false,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 1,
      "ReviewFlags": "",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1204",
      "ObjectGuid": "00000000-0000-0000-0000-000000001204",
      "SamAccountName": "former.user",
      "Name": "Jordan Taylor",
      "UserPrincipalName": "former.user@demo.example",
      "State": "Disabled",
      "Email": "former.user@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Jordan Taylor,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-02-05T17:00:00.0000000Z",
      "ActivityIndicator": "Old replicated timestamp",
      "InactivityCandidate": false,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 1,
      "ReviewFlags": "",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1207",
      "ObjectGuid": "00000000-0000-0000-0000-000000001207",
      "SamAccountName": "never.recorded",
      "Name": "Robin Lee",
      "UserPrincipalName": "never.recorded@demo.example",
      "State": "Enabled",
      "Email": "never.recorded@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Robin Lee,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2026-03-07T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "",
      "ActivityIndicator": "No recorded logon; older account",
      "InactivityCandidate": true,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 1,
      "ReviewFlags": "Inactivity review candidate",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1206",
      "ObjectGuid": "00000000-0000-0000-0000-000000001206",
      "SamAccountName": "primary.admin",
      "Name": "Sam Ellis",
      "UserPrincipalName": "primary.admin@demo.example",
      "State": "Enabled",
      "Email": "primary.admin@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Sam Ellis,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-10-08T17:00:00.0000000Z",
      "ActivityIndicator": "Within review window",
      "InactivityCandidate": false,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": false,
      "AdminCount": 1,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-512",
      "SelectedPrivilegedGroups": "Domain Admins",
      "GroupCount": 1,
      "ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
      "ExceptionNote": ""
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-1205",
      "ObjectGuid": "00000000-0000-0000-0000-000000001205",
      "SamAccountName": "svc.backup",
      "Name": "Backup Service Account",
      "UserPrincipalName": "svc.backup@demo.example",
      "State": "Enabled",
      "Email": "svc.backup@demo.example",
      "Department": "Operations",
      "ManagerName": "",
      "ManagerDN": "",
      "DistinguishedName": "CN=Backup Service Account,CN=Users,DC=demo,DC=example",
      "CreatedUtc": "2025-09-08T17:00:00.0000000Z",
      "LastLogonTimestampUtc": "2026-04-16T17:00:00.0000000Z",
      "ActivityIndicator": "Old replicated timestamp",
      "InactivityCandidate": true,
      "PasswordLastSetUtc": "2026-09-13T17:00:00.0000000Z",
      "PasswordNeverExpires": true,
      "AdminCount": 0,
      "PrimaryGroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "SelectedPrivilegedGroups": "",
      "GroupCount": 1,
      "ReviewFlags": "Inactivity review candidate; Password does not expire; Exception note; still requires review",
      "ExceptionNote": "Synthetic demo: confirm backup service owner and recent job activity"
    }
  ],
  "Memberships": [
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
      "SamAccountName": "alex.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
      "GroupName": "Domain Admins",
      "GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Nested",
      "Depth": 1,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": true,
      "OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
      "SamAccountName": "alex.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
      "SamAccountName": "alex.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-1100",
      "GroupName": "Tier Zero Operators",
      "GroupDN": "CN=Tier Zero Operators,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Direct",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
      "SamAccountName": "blair",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
      "SamAccountName": "blair",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-1101",
      "GroupName": "Engineering",
      "GroupDN": "CN=Engineering,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Direct",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Blair Chen,CN=Users,DC=demo,DC=example -> CN=Engineering,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1202",
      "SamAccountName": "casey.old",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Casey Morgan,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1203",
      "SamAccountName": "devon.new",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Devon Patel,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1204",
      "SamAccountName": "former.user",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Jordan Taylor,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1207",
      "SamAccountName": "never.recorded",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Robin Lee,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
      "SamAccountName": "primary.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
      "GroupName": "Domain Admins",
      "GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": true,
      "OneObservedPath": "CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1205",
      "SamAccountName": "svc.backup",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-513",
      "GroupName": "Domain Users",
      "GroupDN": "CN=Domain Users,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": false,
      "OneObservedPath": "CN=Backup Service Account,CN=Users,DC=demo,DC=example -> CN=Domain Users,CN=Users,DC=demo,DC=example"
    }
  ],
  "SelectedGroups": [
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-512",
      "Name": "Domain Admins",
      "DistinguishedName": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-520",
      "Name": "Group Policy Creator Owners",
      "DistinguishedName": "CN=Group Policy Creator Owners,CN=Users,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-32-544",
      "Name": "Administrators",
      "DistinguishedName": "CN=Administrators,CN=Builtin,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-32-548",
      "Name": "Account Operators",
      "DistinguishedName": "CN=Account Operators,CN=Builtin,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-32-549",
      "Name": "Server Operators",
      "DistinguishedName": "CN=Server Operators,CN=Builtin,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-32-550",
      "Name": "Print Operators",
      "DistinguishedName": "CN=Print Operators,CN=Builtin,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-32-551",
      "Name": "Backup Operators",
      "DistinguishedName": "CN=Backup Operators,CN=Builtin,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-518",
      "Name": "Schema Admins",
      "DistinguishedName": "CN=Schema Admins,CN=Users,DC=demo,DC=example",
      "CollectionState": "Collected"
    },
    {
      "SID": "S-1-5-21-111111111-222222222-333333333-519",
      "Name": "Enterprise Admins",
      "DistinguishedName": "CN=Enterprise Admins,CN=Users,DC=demo,DC=example",
      "CollectionState": "Collected"
    }
  ],
  "PrivilegedMemberships": [
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
      "SamAccountName": "alex.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
      "GroupName": "Domain Admins",
      "GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Nested",
      "Depth": 1,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": true,
      "OneObservedPath": "CN=Alex Rivera,CN=Users,DC=demo,DC=example -> CN=Tier Zero Operators,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
      "SamAccountName": "primary.admin",
      "GroupSID": "S-1-5-21-111111111-222222222-333333333-512",
      "GroupName": "Domain Admins",
      "GroupDN": "CN=Domain Admins,CN=Users,DC=demo,DC=example",
      "MembershipKind": "Primary",
      "Depth": 0,
      "SecurityOnlyPath": true,
      "SelectedPrivilegedGroup": true,
      "OneObservedPath": "CN=Sam Ellis,CN=Users,DC=demo,DC=example -> CN=Domain Admins,CN=Users,DC=demo,DC=example"
    }
  ],
  "Worksheet": [
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1200",
      "SamAccountName": "alex.admin",
      "Name": "Alex Rivera",
      "State": "Enabled",
      "ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
      "SelectedPrivilegedGroups": "Domain Admins",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1201",
      "SamAccountName": "blair",
      "Name": "Blair Chen",
      "State": "Enabled",
      "ReviewFlags": "",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1202",
      "SamAccountName": "casey.old",
      "Name": "Casey Morgan",
      "State": "Enabled",
      "ReviewFlags": "Inactivity review candidate",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1203",
      "SamAccountName": "devon.new",
      "Name": "Devon Patel",
      "State": "Enabled",
      "ReviewFlags": "",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1204",
      "SamAccountName": "former.user",
      "Name": "Jordan Taylor",
      "State": "Disabled",
      "ReviewFlags": "",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1205",
      "SamAccountName": "svc.backup",
      "Name": "Backup Service Account",
      "State": "Enabled",
      "ReviewFlags": "Inactivity review candidate; Password does not expire; Exception note; still requires review",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "Synthetic demo: confirm backup service owner and recent job activity",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1206",
      "SamAccountName": "primary.admin",
      "Name": "Sam Ellis",
      "State": "Enabled",
      "ReviewFlags": "Selected privileged group membership; adminCount=1 (may be historical)",
      "SelectedPrivilegedGroups": "Domain Admins",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    },
    {
      "UserSID": "S-1-5-21-111111111-222222222-333333333-1207",
      "SamAccountName": "never.recorded",
      "Name": "Robin Lee",
      "State": "Enabled",
      "ReviewFlags": "Inactivity review candidate",
      "SelectedPrivilegedGroups": "",
      "ExceptionNote": "",
      "SuggestedAction": "Review with owner",
      "Reviewer": "",
      "Owner": "",
      "Decision": "",
      "DecisionReason": "",
      "DecisionDateUtc": "",
      "TicketReference": ""
    }
  ],
  "Issues": [],
  "UnexpandedMembers": []
}