- 12 tests: user filtering, claim format matching, Direct/Group/Inherited access type classification, Full Control + SCA high-privilege detection, external user flagging (#EXT#), semicolon user/level splitting, multi-site scan