RBAC visibility: considered follow-ups #1090

Tracking the follow-ups that were considered for the Access Control (RBAC visibility) feature and deliberately left out of the first pass (moved here from the README so the feature section stays user-facing):

• RBAC audit checks: wildcard / cluster-admin / orphan-binding / unused-role detection (Kubescape-aligned)
• Verb × resource matrix view on the ServiceAccount page (rakkess-style)
• "Subject Explorer" top-level page for browsing Users / Groups without a detail page today
• Graph topology view of Subject → Binding → Role → Rule (rbac-tool viz style)
• In-UI binding edits
• "can-i" free-form query UI

Read-only visibility shipped first; revisit once we see how operators use the reverse-lookup.

🤖 Generated with Claude Code