I built an open-source Kubernetes operator that watches audit logs and generates scoped Role/ClusterRole manifests based on what ServiceAccounts actually access.

The problem: most clusters run with overly permissive RBAC because getting it right manually is tedious.

You end up with cluster-admin bindings everywhere or spend hours crafting policies by hand.

Audicia flips it — ingest audit logs (file or webhook), normalize the access patterns, and output least-privilege RBAC.

It also diffs observed vs. granted permissions to produce a compliance score.

Everything runs as a controller in your cluster via CRDs. No SaaS, no external dependencies.

GitHub: github.com/felixnotka/audicia Website: audicia.io

Happy to answer any questions about the architecture or approach.