Suspend, revoke, migrate or assign at scale — preview is mandatory before anything executes (OPS-005).
Audit notice: every preview and execution is recorded in the enhanced audit chain with your identity, the filter, and the affected count. Bulk revoke additionally requires re-authentication (ADR-034). A preview can be executed only once.