AI/ML Access Diagnostics

Diagnose why an AI/ML service call was denied. Walk the authorization chain hop by hop, name the hop that denied the call, and propose a scoped IAM policy for human review. Read-only throughout.

Checklist

Work through these steps in order. Each is detailed in its own section below.

• Step 1 — Classify the request: confirm the service is Bedrock or SageMaker, and that there is an observed failure (not a speculative audit). Stop otherwise.
• Step 2 — Establish identity and scope: record the agent's own identity, extract the principal/action/resource ARNs, and flag cross-account.
• Step 3 — Collect evidence, policy reads first: read the chain's policy documents by hand; use CloudTrail and simulation only as corroboration.
• Step 4 — Walk the chain: traverse the six hops in precedence order; do not stop at hop 1 just because it passed.
• Step 5 — Apply service-specific knowledge: rule out non-IAM denial causes for the service explicitly.
• Step 6 — Assign verdicts: give every hop exactly one token from the closed verdict set.
• Step 7 — Propose a policy: derive a scoped policy for human review; keep observed and commonly-required permissions labelled separately.
• Step 8 — Deliver the report: render per the report format, run the pre-render validation, then deliver.