Estate, workforce risk and reminders
Who works here, what they use, how exposed each is, and reminders that close the gaps.
In the consoleWorkforce risk
aertun estate build
aertun estate scores --limit 20
aertun workforce coverage
aertun workforce gaps
aertun remind preview
aertun remind sendThe estate joins the people your identity provider knows with the devices, training records and accounts other tools report, leavers included. A person's score is a file on an employee, so the Workforce risk screen is for administrators only, and the MCP interface shows only numbers, never names.
Vendors and access reviews
aertun vendor reconcile
aertun vendor review ID
aertun access open q4 identities.jsonl --scope okta,github --due 2026-12-10
aertun access decide q4 okta:00u1abc revoke
aertun access close q4 identities-after.jsonlEach account is kept, revoked or reduced. A review closes on a later import, which shows whether what was decided was done; without one, a revocation is reported as unverified.