Good point. I do understand IAM policies and sense checked them myself to make sure they only covered the MCP group that was created and don't provide access to any other OCI services.

Also, in this case, IAM is really only being used for Authentication. Authorization is being handled in the database. I tie the IAM user to a local user access table in the DB, and the DB logic and a VPD determine what the user has access to.

got it, keeping IAM for auth and pushing authorization into the DB is a cleaner split than i was picturing. thanks for walking through it.