=== Resumen SAs por cluster ===

--- PRODUCTION cluster ServiceAccounts in rbac-sod namespace ---
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/holder":"Gabriel Ureña (CTO)","pci.fintrixs.com/role":"Production CTO — full access","pci.fintrixs.com/scope":"All namespaces, all resources"},"name":"admin-prod","namespace":"rbac-sod"}}
      pci.fintrixs.com/holder: Gabriel Ureña (CTO)
      pci.fintrixs.com/role: Production CTO — full access
      pci.fintrixs.com/scope: All namespaces, all resources
    name: admin-prod
  - name: registry-fintrix
    name: default
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/holder":"GitHub Actions service account","pci.fintrixs.com/role":"Production CI/CD deployer","pci.fintrixs.com/scope":"default namespace ONLY (microservicios PCI)"},"name":"deployer-prod","namespace":"rbac-sod"}}
      pci.fintrixs.com/holder: GitHub Actions service account
      pci.fintrixs.com/role: Production CI/CD deployer
      pci.fintrixs.com/scope: default namespace ONLY (microservicios PCI)
    name: deployer-prod
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/role":"Production read-only","pci.fintrixs.com/scope":"All namespaces, read-only (NO secrets, NO exec)","pci.fintrixs.com/use-case":"On-call observers, external auditors, QSA"},"name":"viewer-prod","namespace":"rbac-sod"}}
      pci.fintrixs.com/role: Production read-only
      pci.fintrixs.com/scope: All namespaces, read-only (NO secrets, NO exec)
      pci.fintrixs.com/use-case: On-call observers, external auditors, QSA
    name: viewer-prod

--- STAGING cluster ServiceAccounts in rbac-sod namespace ---
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/holder":"CTO + Lead Engineer","pci.fintrixs.com/role":"Staging admin","pci.fintrixs.com/scope":"Full cluster-admin on staging"},"name":"admin-staging","namespace":"rbac-sod"}}
      pci.fintrixs.com/holder: CTO + Lead Engineer
      pci.fintrixs.com/role: Staging admin
      pci.fintrixs.com/scope: Full cluster-admin on staging
    name: admin-staging
    name: default
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/holder":"GitHub Actions (pull_request trigger)","pci.fintrixs.com/role":"Staging CI/CD deployer","pci.fintrixs.com/scope":"default namespace ONLY"},"name":"deployer-staging","namespace":"rbac-sod"}}
      pci.fintrixs.com/holder: GitHub Actions (pull_request trigger)
      pci.fintrixs.com/role: Staging CI/CD deployer
      pci.fintrixs.com/scope: default namespace ONLY
    name: deployer-staging
        {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{"pci.fintrixs.com/holder":"Developers (current: Gabriel; future: hires)","pci.fintrixs.com/restriction":"NO access to production cluster","pci.fintrixs.com/role":"Staging developer — full edit access","pci.fintrixs.com/scope":"All namespaces in staging cluster"},"name":"developer-staging","namespace":"rbac-sod"}}
      pci.fintrixs.com/holder: 'Developers (current: Gabriel; future: hires)'
      pci.fintrixs.com/restriction: NO access to production cluster
      pci.fintrixs.com/role: Staging developer — full edit access
      pci.fintrixs.com/scope: All namespaces in staging cluster
    name: developer-staging

--- Bindings creadas (CTO designed SoD model) ---
NAME                                                               ROLE                               AGE     USERS   GROUPS   SERVICEACCOUNTS
clusterrolebinding.rbac.authorization.k8s.io/admin-prod-binding    ClusterRole/cluster-admin          2m33s                    rbac-sod/admin-prod
clusterrolebinding.rbac.authorization.k8s.io/viewer-prod-binding   ClusterRole/viewer-prod-readonly   2m33s                    rbac-sod/viewer-prod
NAME                                                                     ROLE                                 AGE     USERS   GROUPS   SERVICEACCOUNTS
clusterrolebinding.rbac.authorization.k8s.io/admin-staging-binding       ClusterRole/cluster-admin            2m29s                    rbac-sod/admin-staging
clusterrolebinding.rbac.authorization.k8s.io/developer-staging-binding   ClusterRole/developer-staging-role   2m31s                    rbac-sod/developer-staging
