A policy statement combines an effect, an action, and a resource scope. An Allow makes matching requests eligible; an explicit Deny can still block them. A request that has no applicable allow is denied implicitly. The resource must fit the action. S3 ListBucket applies to a bucket ARN, while GetObject applies to an object ARN that includes the key.
Wildcards save repetition but widen scope. A policy that allows every S3 action may pass a quick read test while also granting deletion. Test what should work and what must remain blocked. In the exercises, the policy document is a JSON file you can inspect and edit. The checker evaluates permissions on concrete requests instead of requiring one exact JSON layout.