Least by Juste™
Least Privilege. Proven.
Access review autopilot for Google Workspace. A production IAM SaaS that runs a 9-rule deterministic risk engine, enriches every finding with Claude AI, generates PDF audit reports, and runs automated daily scans — built solo from scratch in 2025–2026.
Architecture
| Layer | Stack | Host |
|---|---|---|
| Frontend | Next.js 14 · Tailwind CSS · shadcn/ui | Vercel |
| Backend API | Python 3.13 · FastAPI · 10 routers | Render |
| Database | Supabase PostgreSQL · 4 tables | Supabase |
| Auth | Supabase Auth + PKCE OAuth 2.0 (Google) | Google Cloud |
| AI Layer | Anthropic claude-sonnet-4-6 | Anthropic API |
| Resend transactional email | Resend | |
| Cron | Vercel Cron → Render admin endpoint | Vercel + Render |
| Billing | Stripe (configured) | Stripe |
9-Rule Risk Engine
Pure deterministic Python functions — no ML, no model drift, no hallucinated findings. Every rule maps to a specific SOC 2 Trust Services Criteria.
| Rule ID | Severity | Finding | SOC 2 |
|---|---|---|---|
| RULE-001 | HIGH | Super Admin detection | CC6.3 |
| RULE-002 | HIGH | Service account with admin privileges | CC6.6 |
| RULE-003 | HIGH | Suspended user retains group memberships | CC6.7 |
| RULE-008 | HIGH | Shared account in production environment | CC6.1 |
| RULE-004 | MEDIUM | User in excessive number of groups | CC6.3 |
| RULE-005 | MEDIUM | User without MFA accessing sensitive data | CC6.6 |
| RULE-006 | MEDIUM | External user with internal access | CC6.7 |
| RULE-007 | MEDIUM | Dormant service account (90+ days) | CC6.1 |
| RULE-009 | MEDIUM | Role assigned outside standard group | CC6.3 |
Features
9-Rule Deterministic Risk Engine
Pure Python functions, no ML. 4 HIGH severity rules (RULE-001 through -003, -008) and 5 MEDIUM rules covering super admins, service accounts, group bloat, MFA gaps, dormant accounts, and more. Maps directly to SOC 2 CC6.x controls.
AI-Powered Explanations
Each risk finding is enriched with a plain-English explanation and remediation recommendation generated by Claude (claude-sonnet-4-6). Includes graceful fallback if the AI layer is unavailable — the deterministic engine always runs first.
Automated Daily Scans
Vercel Cron triggers a scan at 08:00 UTC every day. The cron endpoint calls the Render backend, which queries the Google Admin SDK, runs the risk engine, enriches findings, and stores results in Supabase. Email summary sent via Resend.
PDF Audit Reports
On-demand PDF generation using ReportLab. Reports include finding counts, risk breakdown, framework citations (SOC 2, ISO 27001), and per-finding details with AI recommendations. Generated in-memory, streamed to the browser.
PKCE OAuth 2.0 + Google Admin SDK
Three read-only Google Workspace scopes: Admin Directory users/groups/roles. PKCE flow with in-memory code_verifier cache keyed by user_id. Connected workspaces stored in tenant_connections table with one connection per user.
SOC 2-Aligned Evidence
Every finding cites specific SOC 2 Trust Services Criteria: CC6.1, CC6.3, CC6.6, CC6.7. Designed for SMBs preparing for their first SOC 2 audit who need automated access review evidence without a dedicated GRC team.
Full Stack
Try it live
Connect your Google Workspace and run your first access review in under 10 minutes.
Open Least by Juste™