2 commits

Author	SHA1	Message	Date
Cursor Agent	740ba53d3d	ci(iam): fail closed on widened policies (PLAT-234) ... Compare new and removed SCPs, and fail when a Deny shrinks or a Condition changes. Run CheckNoNewAccess on bootstrap templates from the base repo. Install the base worktree's own dependencies and warn when analyzer credentials are skipped. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>	2026-09-28 15:59:18 +00:00
Cursor Agent	5907cd3467	ci(iam): check synthesized policies with Access Analyzer (PLAT-234) ... Adds a CI job that checks bootstrap trust for StringEquals, rejects lambda writes on the plan refresh template, and runs ValidatePolicy plus CheckNoNewAccess when the policy-check role can be assumed. Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>	2026-09-28 00:56:51 +00:00