A permission decision depends on the request context as well as the action and resource. Conditions can require a transport setting, tag, source, or other supported context value. A condition that doesn't match can't supply its statement's allow. Missing context needs special care: don't assume that a missing value is equivalent to a trusted value.
The policy simulator in this course explains matching allows, explicit denies, and implicit denial for the modeled policy types. Use it to test a positive request and a negative request, then read the reason. A successful read alone can't establish least privilege. The edge exercise adds a required condition and checks both a false value and an absent value, so a broad unconditional allow will fail.