A working credential is not a governance model
A research prototype often starts with a small team and broad permissions. Production introduces automation, multiple projects, cost ownership and external obligations. If every program uses a person’s unrestricted key, its access can outlast the original reason for granting it.
A current example
Lambda’s 4 November 2026 IAM announcement describes role-based access, groups and service identities. It separates workspace membership from the permissions attached to a role. That is a concrete example of the controls buyers should examine, rather than an assertion that any particular configuration satisfies their obligations.
Ask for the evidence
Map the people and services that can create resources, read data, change network settings and delete artifacts. Document how access is approved, rotated and removed. Confirm whether logs record the events needed for an investigation and who can access those logs. Physical isolation and application permissions solve different problems.
Prepare a reviewable brief
Our Readiness Review includes an access-control gate and a data-path gate. Use them to list evidence still required from the chosen provider or internal team. The review is an evidence checklist with visitor-entered status, not a security assessment, compliance certification or automated inspection of a cloud account.