Enforces GrantForge policies in MongoDB with MongoDB's own access control: a service beside the deployment that keeps one role per user holding exactly what the service's signed policies give the user, and replaces its privileges in one step when they change. It undoes changes made to the roles by hand, reads built-in and custom roles outside GrantForge for what a policy denies, and reports accesses from the audit log of MongoDB Enterprise and Percona Server or ...