From 47b4eb68d1191d50db2cedbd710dfcd006d5a4f1 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 28 Sep 2026 17:36:39 +0000 Subject: [PATCH] docs(iam): limit scoping rule to remaining SAM workloads (PLAT-52) The shared boundary shrink is unchanged. The scoping note now matches the HCP path already stated later in the same file. Co-authored-by: Adam Moussa --- lib/deploy-substrate/deploy-substrate.template.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml index 638277c..380c4d2 100644 --- a/lib/deploy-substrate/deploy-substrate.template.yaml +++ b/lib/deploy-substrate/deploy-substrate.template.yaml @@ -217,7 +217,7 @@ Resources: # intersection of the role's own policies and this boundary, so a misconfigured # SAM role can never exceed what is listed here. # - # SCOPING RULE (PLAT-52). New workloads get their own ManagedPolicy + # SCOPING RULE (PLAT-52). Remaining SAM workloads get their own ManagedPolicy # seahaven-lambda-execution-boundary-: the four-statement floor # (CloudWatchLogsWrite / CloudWatchLogsDescribe / XRay / Ec2Eni) plus that # workload's data plane, derived from its own template. The shared