// GLOSSARY

Effective Permissions

The gap between an identity's permissions defined on paper and the real access that remains after those permissions intersect with policies, boundaries and conditions. In cloud environments what an identity can reach cannot be understood by reading the single policy attached to it, because real access arises from computing permission policies, permission boundaries, service control policies and condition expressions all together. AWS, Azure and GCP each evaluate this intersection by different rules, and the result is often broader than the administrator expects. The space between is where both excess privilege and mistaken trust assumptions hide: a role believed to be 'read only' can, combined with another policy, become write authority. Effective permissions are therefore found not by reading a configuration but by computing it; they are the starting point of privilege-chain and transitive-privilege analysis and the real question of cloud IAM assessments.