Find outsiders with edit rights on your Asana projects

**Objective:** Audit access to the Asana project `{project-name}` and list anyone whose access looks wrong. Treat email domains other than `{internal-domain}` as external (if no domain is given, take the project owner's email domain).

**Step 1: Identify the project**

Call `asana-get-project` with `name` set to `{project-name}`. If none or more than one project matches, list what you found and stop. Record the `project-id`, owner, team and privacy setting.

**Step 2: Read the members**

Call `asana-get-project-memberships` with `project-id` set to the project id. For each member record the member, `member-id`, user, `user-id`, `access-level` and `write-access`.

**Step 3: Enrich**

* Call `asana-get-user` for each distinct `user-id` to get the email address.
* Call `asana-get-team-memberships` with `team` set to the project's team, to learn which members are team admins, guests or limited-access.
* Call `asana-get-audit-log-events` with `resource-id` set to the project id and `created-at.from` set to 90 days ago, to find recent membership and permission changes. If the audit log returns an error or nothing, note that it is unavailable and carry on.

**Step 4: Report**

A table of every member: name, email, access level, write access, team role (admin, member, guest, not on team). Then list the flags:

* external email domains with any access, and especially with write access
* guests with editor or admin access
* members who are not on the project's team, for a project whose privacy setting limits it to the team
* access granted in the last 90 days, with who granted it, from the audit log

End with recommended changes, each naming the member and the access level you suggest.

**Rules & Guidelines:**

* Read-only. Do not call `asana-update-membership`, `asana-create-membership`, `asana-add-members-for-project` or `asana-add-user-for-team`, or any other create, update or add tool. Recommend; the user decides.
* A flag is a question to review, not proof of a problem. Say so once at the top.

**Validation:**

* If the project has no memberships listed, say so and note the privacy setting, since a public project may be open to everyone in the workspace.