- document production-correct AD dual-account and privileged OU handling
- record policy-aware identity confidence implementation status
- capture explainability improvements in identity output semantics
- note Entra admin-consent as external blocker with clean handoff next steps
