IAM effective access API - who can reach a resource, and what can a subject reach

Problem:
There is no API that answers "who has access to this resource". The only way is to read every access policy, access group membership, service ID and trusted profile of the account and re-implement IAM's matching client-side: operators (stringEquals, stringMatch, the AnyOf forms, stringExists), serviceType=service versus platform_service, resource group policies, narrower attributes such as a bucket or a COS prefix, time and IP conditions, access tags. Any difference between that re-implementation and IAM's own evaluation gives a wrong answer in an audit.

Use case:
Access reviews and audits for regulated clients: "who can delete objects in this bucket?", "what can this service ID reach?", "what changes if we remove this user from this group?". Today each tool has to rebuild IAM's evaluation and keep it in step with IAM.

Request:
- Given a resource (CRN or attributes): every subject that can reach it, through which policy or access group, with which roles and conditions.
- Given a subject (user, service ID, trusted profile): every resource and role it can reach.
- The account owner's implicit access stated explicitly in the answer.