Start read-only
Optimization does not require write access. A read-only audit reduces security risk and keeps remediation decisions inside the customer's own change process.
Close the loop
A finding is not complete when it is discovered. Track owner review, action status, and whether the next invoice reflects the expected reduction.