`kubectl auth can-i --list` shows all permissions for the current user or service account. This is the primary tool for RBAC enumeration during a penetration test.