It's protection against mistakes where you've accidentally granted more access than was intended. For instance, if someone does a wildcard resource "acme-prod-

It's protection against mistakes where you've accidentally granted more access than was intended. For instance, if someone does a wildcard resource "acme-prod-widget-*" for a new policy, but forgets that widget also has (say) a customer-pii bucket, too. Well, if acme-prod-widget-customer-pii is encrypted with a customer-pii specific KMS key, then there's no accidental leak of that data.