Requester: Orchard security lead. Evidence: the user has a permissions boundary and a missing identity grant. Question: restore the required read while keeping deletion, private-prefix access, and insecure requests outside the approved behavior.
Orchard Audit has a report reader who cannot complete one authorized request. You will work through one account, carrying every accepted change into the next step. The initial resources are a fictional company's starting configuration, not a blank cloud account. Your deliverable is the final account state and the checked decision at the end.
Inspect the named resources before changing them. Earlier work remains part of the requirements, so a later step must preserve it. Some steps use a prepared JSON or YAML file; read its contents and then verify the resulting configuration. Other steps ask for a recommendation supported by the evidence you've established. The final check includes previous requirements as well as the new one, which prevents a quick repair from undoing an earlier protection.