--- id: iam-policy-scan track: coding version: 0.1.2 label: blocks keyword: block where: write turn-end sha256: e5c37ef96755ed2d6cc8e6e771338fb3a489a1948da0327874c9d722856eb59a source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/iam-policy-scan catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # IAM Policy Scan iam-policy-scan · version 0.1.2 Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Reads whole IAM, RBAC and role documents, not lines: JSON, YAML, Terraform, ARM, Bicep, Kubernetes. Refuses Allow with Action star or an inverted key, public or any-principal trust, cluster-admin, subscription Owner. Asks for service wildcards on a named resource, cross-account trust. Only added grants. Misses computed grants, partial wildcards, GCP, Azure role definitions, k8s escalate/bind/anonymous, unlisted extensions. Waiver: pragma or sidecar. ## Its label on each agent - Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=iam-policy-scan - Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=iam-policy-scan - Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=iam-policy-scan - GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=iam-policy-scan - Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=iam-policy-scan - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=iam-policy-scan - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=iam-policy-scan - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=iam-policy-scan - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=iam-policy-scan - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=iam-policy-scan - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=iam-policy-scan ## What it misses This policy does not state what it misses. ## Examples - Refused: A JSON policy grants Action star as a list split across lines. - Allowed: A policy lists scoped actions over several lines. ## Latest change 0.1.2 · 2026-10-25 — Behaviour change, added coverage for YAML that carries template markers: a file counts as a template by its path (a \`templates/\` directory), never by \`{{\` or \`{%\` in its text, so a marker in a comment no longer lets an unreadable file pass; a template that still does not read after its directives are set aside is now refused as \`iam-unreadable\` instead of skipped. Behaviour change, hardening for sidecar waivers: in the agent a waived grant is excused at most as many times as HEAD's copy of the file holds it (at least once), so a copy of a waived statement added elsewhere in the file is judged; a person's commit still trusts the staged waiver. ## Provenance - Tested by 51 of 51 cases run automatically - SHA-256: `e5c37ef96755ed2d6cc8e6e771338fb3a489a1948da0327874c9d722856eb59a` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/iam-policy-scan (catalog path `agentic-security/iam-policy-scan`) - Presets: Cloud and containers - JSON: `/api/coding/policies/iam-policy-scan.json` - Report a problem: https://chock.sh/report/?policy=iam-policy-scan&version=0.1.2&page=%2Fcoding%2Fpolicies%2Fiam-policy-scan%2F