Decisions
Why IAM works the way it does.
Allows only
A policy lists what's allowed; nothing denies. What isn't written is
refused, so reading a principal's policy shows everything it reaches.
Every check goes through allows, the one place a deny could be added.
A grant is actions on resources
A grant holds no condition (an address, a time, hours of the day). An
end is the principal's, and how much is the policy's [limits], kept
by the service that meters it. With nothing else in a grant, it reads
as what it reaches.
Limits name their unit
A limit is a whole number with its unit in its name (memory_gb,
hours), so a limit compares with what a service counts without a
unit to read.
* is the principal's own account
* alone, and a pattern without an account, reach the principal's own
account. Another account's resources are reached only by a grant that
says so (*/cloud:*, or that account's id) and that resource's
[access]: both sides decide.
A host issues guests
A self-hosted host has no account service, so it is its own authority
and issues principals of its own, guest:, as a self-run relay issues
its own API keys. A guest always expires: a cloud session's container is
thrown away, so its principal ends in hours.
A child has one maker
A principal or resource made by another names its maker, and ends with it. One maker each, and none its own, so ending one is a walk down a tree that always stops.
A role is on the principal
Inside an account, the principal's policy and its roles alone decide
what it reaches: a resource's own file never widens it. So reading a
principal's policy and its roles shows everything it may do, and a
resource's [access] is only for those outside its account.
A role is named by its name
A role's name never changes: renaming one is making another, so a grant given under one name never moves to a role that later takes it.