output "role_id" {
  description = "ID of the Engineering Datadog role (use this when reassigning users)."
  value       = datadog_role.engineering.id
}

output "role_name" {
  description = "Name of the Engineering Datadog role."
  value       = datadog_role.engineering.name
}

output "granted_permission_count" {
  description = "Number of grantable permissions actually attached to the role."
  value       = length(local.resolved_permissions)
}

output "unresolved_permissions" {
  description = "Allowlist names Datadog did not return as grantable (dropped); review for typos."
  value = sort([
    for name in local.granted_permissions : name
    if !contains(keys(data.datadog_permissions.all.permissions), name)
  ])
}

output "restricted_by_role" {
  description = "Grantable permissions NOT granted by this role (the write/elevated capabilities it locks down)."
  value = sort([
    for name, id in data.datadog_permissions.all.permissions : name
    if !contains(local.granted_permissions, name)
  ])
}