the "knowing what good looks like" bit is what I keep wondering about. when the agent is running OCI CLI commands for you, how do you actually review that it didn't leave something too permissive, like those 2 IAM policies? do you read the diff or just test the outcome?
Good point. I do understand IAM policies and sense checked them myself to make sure they only covered the MCP group that was created and don't provide access to any other OCI services.
Also, in this case, IAM is really only being used for Authentication. Authorization is being handled in the database. I tie the IAM user to a local user access table in the DB, and the DB logic and a VPD determine what the user has access to.
WIO
the "knowing what good looks like" bit is what I keep wondering about. when the agent is running OCI CLI commands for you, how do you actually review that it didn't leave something too permissive, like those 2 IAM policies? do you read the diff or just test the outcome?