Educational / lab material. Every identity, group, and relationship in this post is simulated data.
Start with the subject
I choose a test account, list its direct permissions, then expand into groups and indirect relationships. Each edge in the graph needs a source, a capture time, and a corresponding verification question.
Safe example: user-test → group-lab → resource-demo. These names illustrate a documentation method and do not describe a real domain.
What makes a map trustworthy
Do not confuse “visible” with “usable.” Separate inventory, policy, and effective access into three layers, and record which layer was actually checked in the lab.
Takeaway
A small graph with annotations is often more useful than a large image without provenance.