+
−
⟲
Identity based
policy
SCP
Boundary
Effective
permission