{"id":"iam-minimize","title":"IAM policy action minimizer: wildcards to the required action list","description":"Takes an AWS IAM policy JSON and the exact list of actions a task needs (up to 300), and returns the policy with each Allow statement's Action narrowed to just those actions, plus what the original over-grants: wildcards, unused actions, Allow+NotAction, required actions no statement grants, and required actions an unconditional Deny blocks. For an agent that is about to attach or propose a policy. Wildcards are matched case-insensitively with * and ?, as IAM does. It does not evaluate Resource ARNs, Conditions, permission boundaries, SCPs or session policies, and it ships no AWS action catalog: pass knownActions (from the AWS service reference) to measure how many extra actions a wildcard grants. The minimized policy is only as complete as the required list.","roi":"s3:* where s3:GetObject was needed is the usual over-grant. The minimized policy and the witnesses show the exact difference.","audience":"developer","package":"infra-preflight-kit","channels":["x402","mcp"],"endpoint":{"method":"POST","url":"https://agents.writerslogic.com/api/v1/iam-minimize","path":"/api/v1/iam-minimize","contentType":"application/json"},"price":{"amount":"0.005","currency":"USDC","network":"base","perCall":true,"failedCallsCharged":false},"inputSchema":{"type":"object","additionalProperties":false,"required":["policy","requiredActions"],"properties":{"policy":{"description":"The IAM policy document as a JSON object or JSON string. At most 60,000 characters."},"requiredActions":{"type":"array","minItems":1,"maxItems":300,"items":{"type":"string","minLength":3,"maxLength":128},"description":"Concrete actions the task needs, e.g. s3:GetObject. No wildcards."},"knownActions":{"type":"array","maxItems":3000,"items":{"type":"string","maxLength":128},"description":"Optional catalog of real actions (from the AWS service reference JSON), used to count what each wildcard grants."}}},"resultSchema":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"minimized":{"description":"Null when the policy is malformed. The policy with Allow actions narrowed to the required list; Deny statements, Resource, Condition and other elements are unchanged."},"statements":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"effect":{"type":"string"},"action":{"type":"string","enum":["kept","narrowed","dropped","unchanged"]},"before":{"type":"array","items":{"type":"string"}},"after":{"type":"array","items":{"type":"string"}}}}},"notGranted":{"type":"array","items":{"type":"string"},"description":"Required actions no Allow statement grants."},"unverified":{"type":"array","items":{"type":"string"},"description":"Things this check could not evaluate (Resource scope, conditional Deny, empty catalog matches)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"outputSchema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"minimized":{"description":"Null when the policy is malformed. The policy with Allow actions narrowed to the required list; Deny statements, Resource, Condition and other elements are unchanged."},"statements":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"effect":{"type":"string"},"action":{"type":"string","enum":["kept","narrowed","dropped","unchanged"]},"before":{"type":"array","items":{"type":"string"}},"after":{"type":"array","items":{"type":"string"}}}}},"notGranted":{"type":"array","items":{"type":"string"},"description":"Required actions no Allow statement grants."},"unverified":{"type":"array","items":{"type":"string"},"description":"Things this check could not evaluate (Resource scope, conditional Deny, empty catalog matches)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]},"example":{"policy":{"Version":"2012-10-17","Statement":[{"Sid":"Read","Effect":"Allow","Action":["s3:Get*","s3:ListBucket","logs:PutLogEvents"],"Resource":"arn:aws:s3:::my-bucket/*"}]},"requiredActions":["s3:GetObject","s3:ListBucket"],"knownActions":["s3:GetObject","s3:GetObjectAcl","s3:GetBucketPolicy","s3:ListBucket","s3:PutObject"]},"openapiOperation":{"operationId":"iam_minimize","summary":"IAM policy action minimizer: wildcards to the required action list","description":"Takes an AWS IAM policy JSON and the exact list of actions a task needs (up to 300), and returns the policy with each Allow statement's Action narrowed to just those actions, plus what the original over-grants: wildcards, unused actions, Allow+NotAction, required actions no statement grants, and required actions an unconditional Deny blocks. For an agent that is about to attach or propose a policy. Wildcards are matched case-insensitively with * and ?, as IAM does. It does not evaluate Resource ARNs, Conditions, permission boundaries, SCPs or session policies, and it ships no AWS action catalog: pass knownActions (from the AWS service reference) to measure how many extra actions a wildcard grants. The minimized policy is only as complete as the required list.\n\nPrice: 0.005 USDC on Base (x402).","x-x402-price-usdc":"0.005","x-x402-amount":"5000","x-payment-info":{"protocols":["x402"],"price":{"mode":"fixed","currency":"USD","amount":"0.005"}},"x-audience":"developer","x-sample-url":"https://agents.writerslogic.com/api/v1/samples/iam-minimize","security":[{"x402":[]},{"apiKey":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"required":["policy","requiredActions"],"properties":{"policy":{"description":"The IAM policy document as a JSON object or JSON string. At most 60,000 characters."},"requiredActions":{"type":"array","minItems":1,"maxItems":300,"items":{"type":"string","minLength":3,"maxLength":128},"description":"Concrete actions the task needs, e.g. s3:GetObject. No wildcards."},"knownActions":{"type":"array","maxItems":3000,"items":{"type":"string","maxLength":128},"description":"Optional catalog of real actions (from the AWS service reference JSON), used to count what each wildcard grants."}}},"example":{"policy":{"Version":"2012-10-17","Statement":[{"Sid":"Read","Effect":"Allow","Action":["s3:Get*","s3:ListBucket","logs:PutLogEvents"],"Resource":"arn:aws:s3:::my-bucket/*"}]},"requiredActions":["s3:GetObject","s3:ListBucket"],"knownActions":["s3:GetObject","s3:GetObjectAcl","s3:GetBucketPolicy","s3:ListBucket","s3:PutObject"]}}}},"responses":{"200":{"description":"Paid result with provenance","content":{"application/json":{"schema":{"type":"object","properties":{"data":{"type":"object","properties":{"status":{"type":"string","enum":["pass","fail","unknown","unsupported"],"description":"pass: every rule held. fail: a rule was violated (see witnesses). unknown: the input lacks the evidence to decide. unsupported: outside what this engine covers. Missing evidence is never a pass."},"minimized":{"description":"Null when the policy is malformed. The policy with Allow actions narrowed to the required list; Deny statements, Resource, Condition and other elements are unchanged."},"statements":{"type":"array","items":{"type":"object","properties":{"index":{"type":"integer"},"effect":{"type":"string"},"action":{"type":"string","enum":["kept","narrowed","dropped","unchanged"]},"before":{"type":"array","items":{"type":"string"}},"after":{"type":"array","items":{"type":"string"}}}}},"notGranted":{"type":"array","items":{"type":"string"},"description":"Required actions no Allow statement grants."},"unverified":{"type":"array","items":{"type":"string"},"description":"Things this check could not evaluate (Resource scope, conditional Deny, empty catalog matches)."},"witnesses":{"type":"array","items":{"type":"object","properties":{"ruleId":{"type":"string"},"detail":{"type":"string"},"path":{"type":"string","description":"JSON pointer or dotted path into the input."},"offset":{"type":"integer"},"index":{"type":"integer"},"expected":{"description":"What the rule required."},"actual":{"description":"What the input had."}}}},"versions":{"type":"object","description":"Every semantic dependency of this answer (engine, tables and their as-of dates, tokenizer, calendar, rounding profile)."},"limits":{"type":"array","items":{"type":"string"}},"deterministic":{"type":"boolean","description":"Always true: pure code, no model."}}},"_provenance":{"type":"object","description":"C2PA-aligned manifest and W3C VC 2.0 (eddsa-jcs-2022) issued by the hub DID; verify at POST /api/v1/verify-provenance"}},"required":["data","_provenance"]}}}},"400":{"description":"Invalid request (no payment consumed)","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"401":{"description":"Invalid X-API-KEY","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}},"402":{"description":"Payment required or invalid","content":{"application/json":{"schema":{"type":"object","description":"x402 v2 PaymentRequired (also base64 in the PAYMENT-REQUIRED header)","properties":{"x402Version":{"type":"integer"},"error":{"type":"string"},"code":{"type":"string"},"resource":{"type":"object"},"accepts":{"type":"array","items":{"type":"object"}},"extensions":{"type":"object"}}}}}},"502":{"description":"Upstream failure; the payment is released or not settled","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string"}}}}}}}},"links":{"docs":"https://agents.writerslogic.com/docs/iam-minimize/","docsJson":"https://agents.writerslogic.com/docs/iam-minimize.json","sample":"https://agents.writerslogic.com/api/v1/samples/iam-minimize","openapi":"https://agents.writerslogic.com/openapi.json","catalog":"https://agents.writerslogic.com/api/v1/catalog","verifyProvenance":"https://agents.writerslogic.com/api/v1/verify-provenance","index":"https://agents.writerslogic.com/docs/index.json"}}