Blast radius. One example… What happens when you give an identity s3:* on resource: *? It can read/modify every bucket in the account that doesn’t have a resource policy with an explicit deny.