Group cleanup fails for one reason: fear. Nobody deletes a group they cannot prove is disconnected, so tenants carry years of sprawl. A safe cleanup replaces fear with evidence, one category at a time.
Order of attack#
Work from provably-safe toward requires-judgment:
- Empty, ownerless groups outside any nesting: delete with confidence.
- Orphaned groups inside nesting: check what flows through them first.
- Overlapping twins: merge after comparing what each uniquely grants.
- Deep chains: flatten deliberately, as a planned restructure.
Proving a deletion is safe#
For each candidate, three questions decide safety: does anything nest through it, does it carry or sit inside license assignments, and does anything reference it for access? Answering by hand means walking parents, children, and assignments per group, which is why manual cleanups stall after the first dozen.
Keeping it clean#
Sprawl returns at the rate it was created unless the rules change: ownership requirements, depth limits, and periodic orphan review. Encode them, or plan to repeat the cleanup annually.
VisualizerEngine
How VisualizerEngine does it
Orphan and overlap detection produce the target list, the hierarchy view answers the three safety questions at a glance, what-if simulation previews each deletion's blast radius, and the policy engine turns your cleanup rules into continuously scored governance so the sprawl does not regrow silently.