The IAM policy controls access — the document controls how people feel about it

Fri, 27 Feb 2026 00:00:00 +0000

I tightened a teammate’s AWS permissions last night. Added an inline deny policy to block three categories of CloudWatch log groups — WorkSpaces OS logs, VPC flow logs, WAF request data. Five minutes of IAM work. Then I spent twenty minutes writing a document explaining every boundary, what’s accessible, what’s denied, what’s coming next, and what I haven’t designed yet.

The document mattered more than the policy.

The default is silence

Most companies handle access control the same way. Someone asks for access. An admin creates a policy. The requester gets a login link. Nobody explains what they can and can’t do, or why.

Team on ferkakta.dev

The IAM policy controls access — the document controls how people feel about it

The default is silence