Cloud privilege is ubiquitous

AWS is not a niche platform. It is the de facto cloud resource provider of the modern, hybrid enterprise. As of May 2026, AWS holds 26% of the cloud hosting market share globally. It is the single most common provider that organizations run production workloads, data storage, and utilize non-human identities. And the scale of identity inside those environments is staggering.

A mature organization does not simply have one AWS account, it has an entire AWS Organization. Hundreds, even thousands, of accounts, each with its own identity access management (IAM) boundary with users, roles, and policies. A single role compromise in a single account may be sufficient to compromise the entire AWS organization. Many such roles carry permissions their authors never intended and certainly never enumerated. Considering the non-human services, workloads, CI-CD pipeline, and compute instances that assume roles, changes are happening rapidly, thousands of times a day, in ways that authors never intended.

The result is an authorization surface that no human can reason with by simply reading policy documents. The policy language is arduously expressive, and the policy evaluation pipeline is complex. Identity policies, resource policies, service control policies, permission boundaries, and trust policies are all intertwined with expressive conditions to make manual analysis a daunting task. Ultimately, organizations drift away from intent and the expressive controls conflict, compound, and even obscure the paths that they create.