Tag
policy-evaluation
- Aug 1, 2026 Attribute-Based Policy Evaluation and Combining Algorithms How XACML-style policies decide by matching attributes and combining rule effects, why deny-overrides is not the same as first-applicable, and what obligations and indeterminate results cost. security
- Jan 27, 2026 Deny Wins: How One Request Is Evaluated Against Many Policy Documents The order in which identity policies, resource policies, boundaries, and organization policies combine to produce a single allow or deny, and why that order is not additive. cloud infrastructure
- Jun 13, 2025 Permission Boundaries and Service Control Policies as Independent Ceilings How two documents that grant nothing restrict what other documents grant, what each one cannot cap, and how their scopes differ by blast radius. cloud infrastructure
- Feb 12, 2025 Attribute Conditions: Constraining Access by Tag Instead of by Name How principal tags and resource tags become condition keys, why the two-sided check needs both halves, and what happens when a tag is missing or renamed. cloud infrastructure
- Jan 16, 2024 Wildcard Semantics in Resource ARNs and Why They Span Separators How the star and question-mark metacharacters match against ARN strings, where their reach exceeds the intent of the author, and how policy variables substitute before matching. cloud infrastructure