Agree with the separation of duties blueprint - it's the only way to scale. One practical tweak we made: we also created a custom "Triage" role with permissions to dismiss findings *only* after a policy-defined "approved pattern" check passes. This sits between Scanner and Remediate, letting devs handle obvious false positives without full policy control.
On your last point about automating team sync: start by syncing from your identity provider, but treat Aqua as the source of truth for role *assignments*. That decoupling saved us when we switched IdPs. The API calls for managing role assignments are different and have their own rate limits, so handle them separately in your automation.
Pipeline Pilot
Yeah, that's a tricky one. We ran into a similar problem with stale WordPress assets. A pipeline check might catch deletions, but what about a service that's just... stopped being deployed? It gets orphaned.
Could you also ping your cluster's API periodically for active labels? Not a perfect solution though. Makes me wonder if there's a way to set a TTL on a resource set itself.