Bulk-fetch a Salesforce org's permission architecture into the local snapshot store. Returns ONLY summary statistics — never permission rows. scope defaults to all tables; pass 'setup_entity_access:apex' to include Apex (off by default).

List available snapshots (newest first) with org, timestamp, and row counts.

Live describe of an object's fields with a sensitivity_guess flag per field (SSN/DOB/account-number/etc from config). Sensitive fields ordered first.

Read-only SOQL. SELECT-only (parser-guarded), hard row cap, identifier columns (Name/Email/Phone/...) redacted before results are returned (DESIGN §2.7).

Profiles in a snapshot: name, license, user count, perm cardinality, and whether they hold ModifyAllData. Sorted by user count desc. Unassigned profiles surfaced.

Symmetric difference of permissions between two principals (profile or permission set). Differing fields grouped by (a_perm, b_perm) signature. The P1 workhorse.

PSGs are out of scope in P1 (they need union-minus-muting resolution — P2's
effective_permissions); passing one returns an instructive error, not a wrong answer.

Every principal granting read/edit on a field whose name matches a sensitivity pattern (SSN/DOB/account-number/card/comp/… from config), with how many users end up with that access (resolved through effective permissions, honoring muting). Recall is prioritized over precision — expect broad matches.

Formal check: does a proposed base-profile + permission-set/group decomposition leave EVERY user's effective permission set unchanged? Returns per-user added/removed grants (both must be empty to pass) and any users the plan fails to cover. This is a boolean, not a vibe — it either preserves privilege exactly or it doesn't.

Propose a thin-base-profile + permission-set decomposition. The STRUCTURE is computed deterministically (cluster the profiles, derive each cluster's shared base and each profile's deviation) and is run through verify_decomposition before it is returned — if it doesn't preserve every user's effective permissions, you get the failure, not the proposal. Names and rationale are deliberately NOT provided: the tool returns placeholder keys plus each base's member profile names and shared grants as raw material for YOU to name in the customer's vocabulary and justify.