{
  "what": "Agent runtime permissions behind the-33 tile 30 (Over-permissioned agents)",
  "read_at": "2026-11-12T12:43Z",
  "read_by": "read-only AWS IAM calls (list-roles, list-attached-role-policies, get-policy, get-policy-version, list-role-policies, get-role-policy)",
  "scope": "The 11 IAM roles the Keystone runtime runs under (API, workers, schedulers and state machines). Build and deploy roles used by CI pipelines are not the AI's runtime and are outside this receipt.",
  "checks": {
    "roles_checked": 11,
    "roles_with_AdministratorAccess_PowerUserAccess_or_IAMFullAccess": 0,
    "roles_allowing_Action_star": 0,
    "roles_allowing_service_wildcards_on_iam_sts_kms_ssm_s3_lambda_or_organizations": 0
  },
  "model_key": "Read from encrypted parameter storage at run time (production code check, 17 June 2026; not re-read on 12 November 2026).",
  "note": "Role and account names are withheld."
}