What a scoped role actually scopes

A platform that provisions infrastructure in your account needs permissions in your account. The honest version of that sentence names them. The dishonest version says "least privilege" and links to a wildcard policy.

Kapten assumes a role you create, and holds no long-lived credential at all — sessions are minted per operation and expire in 900 seconds. The role can create and manage the resources it provisions and nothing else: it cannot read your object storage, it cannot read database contents, and it cannot touch resources it did not create, because every action is conditioned on a tag the control plane sets at creation time.

The useful test is not whether a policy looks short. It is whether you can describe, in one sentence, what the vendor could do on their worst day. For us: create, modify and destroy the infrastructure they provisioned, for fifteen minutes at a time, in one account, with every call in your own audit trail.