Part 1 gave the agent its own identity; part 2 made its calls visible. Neither of those stops a determined mistake. This part is the one that holds when they do. Layer 3 — Enforce: SCP as the hard backstop No matter how careful you are with identity and action-level IAM, give enough engineers this pattern and someone will reuse their admin role , or the one with iam:* , or a production break-glass role. Policy review culture only gets you so far. That's where Service...