A cross-account access analyzer stays green, but a new resource policy grants a service principal wildcard that the analyzer scope does not flag in this org layout

Visibility tooling is present, yet its scope is narrower than the real exposure surface.