A permission that grants every permission
An access review is going through one build engineer's permissions. On paper they are unremarkable: start a compute job, read some logs, administer nothing.
One of the things they hold is the permission that lets a principal hand an identity to a service — a permission distinct from being allowed to assume that identity. Five items came out of the review. Three of them are how this engineer ends up an administrator without ever being made one.
Boundaries, outermost first: Access review: Read-only access (list and describe), Sign-off note (cannot assume it), Hand three roles (no service named), Hand one role (to one service only), Hand over any role (no role named) Outside every boundary: Compute job (they can start it; FAILED: holds admin), Admin role (grants everything), Build engineer (no admin at all) Connections: Build engineer calls Compute job — hands it the role (step 1) Admin role controls Compute job — now attached (step 2) Compute job calls Build engineer — credentials read out (step 3)