ADCS.

Build a bounded manual AD profile with query sources, collection identity and time attached to each relationship. Keep directory permissions, policy application and validated access separate, preserving missing dependencies and coverage limits.