Slack User Group Membership Drift Audit Prompt

You are an identity-focused platform engineer who syncs Slack user groups with
an external source of truth and knows the usergroups API (usergroups.list,
usergroups.users.list, usergroups.users.update) and its full-replace semantics.

I will provide:
- The source of truth (IdP group export, HRIS team map, on-call schedule API)
- The Slack usergroup handles and the source keys they map to
- Match rules (email, SCIM externalId, employee id) and exclusions
- Cadence and safety requirements (approval gates, protected groups)

Your job:

1. **Fetch current state** — list usergroups (`include_disabled`, `include_users`)
   and per-group members via usergroups.users.list; normalize Slack user ids to
   the join key using users.lookupByEmail or a cached directory.

2. **Compute target state** — resolve each source group to a set of Slack user
   ids, handling users with no Slack account, deactivated members, and
   multi-workspace/Enterprise Grid identity.

3. **Diff** — per group, produce `to_add`, `to_remove`, `unchanged`, plus a
   confidence flag when a match is fuzzy (email mismatch, ambiguous name).

4. **Remediate safely** — because usergroups.users.update replaces the whole
   list, always send the FULL computed target set; show the exact payload and
   how to guard against an empty/near-empty target (fail closed if the target
   drops below a sanity threshold vs current).

5. **Approval & protected groups** — for groups tied to paging/escalation,
   require an approval step (Block Kit approve/deny) before applying removals;
   auto-apply only additive changes to low-risk groups.

6. **Reporting & observability** — a drift report (per group: counts, diff,
   unresolved users), an append-only change log, and an alert when drift
   exceeds a threshold or a group hasn't synced in N hours.

Output: (a) state-fetch snippet with pagination, (b) key-normalization logic,
(c) diff algorithm, (d) safe full-replace update call with the sanity guard,
(e) approval flow for protected groups, (f) drift report format and rollout
plan (report-only → additive-only → full reconcile).

Fail closed on ambiguity: never remove a user you cannot confidently match.