See every Bitwarden group and collection on one screen

Build me an internal app for managing which Bitwarden groups can reach which collections. Right now the admin console makes me click into every group one at a time and there is no overview anywhere, so I want one screen that shows the whole picture and lets me fix it in place. This is a structure editing workbench for repairing access, not an access review or an audit sign off.

The main view is a permissions matrix: groups down the left side, collections across the top. Build the columns from List Collections and the body of the matrix from List Groups, which returns each group's collection assignments along with their permission flags. Note that List Collections does not return group assignments, so it can only supply collection names and ids for the column headers, and every cell value has to be assembled from List Groups. Each cell shows the permission level that group holds on that collection (read only, hide passwords, can manage, or full edit access) or an empty state when the group has no access at all. Keep the row and column headers pinned while scrolling, and give me a filter box for group names and one for collection names, since a real organization has too many of both to fit on a screen.

I want to change a cell in place. Clicking a cell opens a small picker for the permission level, including an option to remove that group's access to that collection entirely, and saving writes the change back with Update Group. This is the part to be careful with: every Bitwarden PUT body is a full replacement, so the handler must first read that group's current collection assignments, apply the single change I made, and resend the complete list along with the group's name and external id. If it sends only the changed assignment, the rest of that group's access is silently reset. Show edited cells as pending with a visible before and after until I save them.

The second view lists direct access drift: the people who were handed collection access straight on their own account instead of inheriting it through a group. Read this from List Members, which returns each member's collection access. For each person show which collections they hold directly and at what level, and suggest which existing groups already grant equivalent access. Let me clean up the drift from that view by moving someone into the right group, using Update Member Groups to replace the full set of groups one member belongs to, or Update Group Members to replace the full member list of one group. Both are full replacements too, so read the current state and resend it with the change applied. Where a person's direct collection access should be dropped once they are in the group, use Update Member, and be aware it replaces their role, custom permissions, collection access, and group membership in one body.

I also want to stand up a new team's access in one go by cloning an existing group as a template. Let me pick any group, prefill a new group form with that group's collection assignments and permission flags, rename it, adjust or drop individual assignments before committing, then create it with Create Group.

Guardrail: before saving any change that would remove the last group holding can manage on a collection, stop and warn me plainly (name the collection and say that nothing would be left able to manage it) and make me confirm. Nothing should end up orphaned because I edited a cell too quickly.

Keep a running change log for the session covering every permission change (group, collection, level before, level after), every member moved between groups, and every group created. Give me a button that posts a plain English summary of that log to our security channel in Slack using slackbot Send a Message. Write it as readable sentences a colleague can follow, for example "Gave Support read only access to Shared Vendor Logins and moved Priya Shah out of direct access into the Support group", not a dump of ids or raw field names.

One constraint to design around: collections cannot be created through the Bitwarden API, only edited, so the matrix always works with the collections that already exist. If a collection is missing, the answer is to create it in Bitwarden and refresh, not to add it here.