Assumed-breach Azure/Entra attack-path analyzer: deterministic collectors build a typed identity graph, detectors find privilege-escalation paths, an LLM explains and prioritizes them.