Reviews AWS IAM policies before you merge or attach them: who can do what to which resources, and whether anyone can use them to reach more. Catches privilege escalation through IAM writes and iam:PassRole, trust and resource policies open to any account or any GitHub repository, confused deputies, NotAction allows and condition logic that quietly matches everything, then gives the smallest policy edits that close each path and what to look for in CloudTrail if it is already live.