Executive Summary The app lets a security manager upload an access policy or permissions export and receive an AI-generated review of over-privileged accounts with suggested corrections. Mid-size companies without an IAM team are the buyers. It earns through a monthly subscription. Customer Profile Who: IT or security manager responsible for access control and audit readiness Pain point: access reviews are manual, slow, and usually done only before an audit Current alternative: spreadsheets, or putting the review off Buying trigger: an upcoming compliance audit or a recent access-related incident MVP Scope Build first: (1) policy file upload, (2) AI risk flagging with plain-language explanations, (3) downloadable review report. These three deliver the core value on day one. Postpone: (1) direct integrations with identity platforms, (2) team dashboards, (3) scheduled recurring reviews. Each takes weeks and can wait until customers ask. Tech Stack Build: an AI app builder such as Lovable or Bolt.new, est. $0-25/month (verify current pricing) AI/backend: Claude API, usage-based, est. $10-30/month at early volume (verify current pricing) Payments: Stripe, per-transaction fees and no monthly fee (verify current pricing) Estimated total: roughly $10-55/month, within the $100 budget Pricing Strategy Option A: one-time $99 per report. Easy to sell, but no recurring revenue. Option B: $49/month subscription. Predictable income and fits recurring audit cycles. Option C: freemium with 1 free review, then $49/month. Lowers the barrier but needs more traffic. Recommendation: Option B. Security reviews repeat every quarter or year, so a subscription matches how customers already work, and the price sits below the approval threshold for most managers. Revenue Projection Customers needed: $1,500 ÷ $49 = 30.6, so 31 paying customers Assumed trial-to-paid conversion rates (assumptions, not data): conservative 10% → 310 trials needed; realistic 20% → 155 trials; optimistic 30% → 103 trials Go-to-Market LinkedIn posts about common access review mistakes. First action: publish one post this week. Security communities (subreddits, professional groups). First action: answer 3 access-control questions without promoting. Direct outreach to existing professional contacts. First action: message 10 people with an offer for free early access. 90-Day Plan Weeks 1-2: interview 5 target customers; confirm the pain point Weeks 3-4: working MVP with upload and report Weeks 5-6: 5 free beta users giving feedback Weeks 7-8: add Stripe and launch a landing page Weeks 9-10: first 3 paying customers Weeks 11-12: 10 total customers and a decision on the next feature Risks Sensitive data concerns: customers may hesitate to upload policies. Mitigation: offer a redacted-upload option and state your data handling clearly. Inaccurate AI flags erode trust. Mitigation: label results as recommendations and show the reasoning behind each flag. Low conversion from cold traffic. Mitigation: sell first through personal network and communities.