IAM misconfiguration

The asterisk that grants everything

Cloud access engines evaluate effective policy, not stated intent. Over-permissive grants leave a declared denial that was never enforced and stays reachable.