Least Privilege: Reconcile the sudo Group

Privilege creep: over time, extra accounts were added to the sudo group and never removed. Security signed off on an approved administrator list — /root/policy/approved-admins.txt, one username per line — and nobody else should hold sudo. Reconcile reality against policy: record every current sudo-group member who is NOT on the approved list in the file /root/answers/unauthorized.txt (usernames only, one per line), then remove exactly those from the sudo group, leaving the approved admins' access intact. (Least privilege — maps to NIST AC-6 / AC-2 and 800-171 3.1.5.)