✳ Practice range / Permission design / 8 min

A smaller blast radius

A report service needs one narrow capability. Design permissions that still work when a component fails or is misused.

YOUR CASE FILE

SYNTHETIC DESIGN / IAM-031

Service: daily-report-builder
Needs: read objects under reports/input/ in one storage bucket.
Writes: generated results through a separate delivery service.
Must not: delete inputs, change policies, enumerate other buckets.
Runs: short-lived jobs using a dedicated workload identity.

Current proposal:
  Allow storage:* on every resource
  Use a shared administrator credential

Constraint: authorization is enforced by the storage service,
not by promises in the report builder’s prompt or code.

Download the synthetic case ↓

Nothing is sent to a server. This exercise uses fictional data and makes no changes to any system.

Step 1 of 3

A smaller blast radius

Which permission scope best matches the stated job?

Keep the reasoning.

Find your next idea.