A small Pulumi library that treats IAM safety measures as preconditions instead of preferences. Permissions boundary required by default, wildcard trust policies rejected, wildcard actions refused, every opt-out explicit and grep-able. Plus notes on why the CI pipeline for a security library has to hash-pin its dependencies.