What a routine least-privilege project turned up when we went looking for proof, and the five-minute audit you can run in your own tenant today