Not at all, super appreciate the discussion and your detailed read! > what I'm asking is whether you envision your future as one of ("eh, it's good enough", "w

Not at all, super appreciate the discussion and your detailed read! > what I'm asking is whether you envision your future as one of ("eh, it's good enough", "we're integrating more libraries that attempt to formalize IAM", or "we'll roll our own policy engine in python, how hard could it be") It's a combination of 2 and 3. Today we use the policyuniverse library for things like s3 bucket-policies, and we have that self-rolled policy engine described in that blog post I shared. I should've mentioned earlier that this is the first time I've seen IAMSpy, thanks for sharing. I think we're currently pretty good at permissions evaluation since that feature gives lots of value as it is, but there is a lot more to do. Continuing to improve this and being able to connect that with other data is a priority since it's one of our main value propositions. > there is a massive opportunity for expectations being out of alignment unless you have a plan to get from where you are to Industrial Grade Introspection. Industrial Grade Introspection is absolutely the plan. I'll also add that we're especially interested in highlighting cases that involve permissions that go between providers - like Okta->AWS, Opal->AWS, etc - and we intend to be very competitive here.