ARK-458 — Cloud IAM Role Grant · Exact-Action Binding

ARK-458 — ExecutionProof Authorization Boundary Experiment — Cloud IAM Role Grant · Exact-Action Binding Verdict: PASS (g_allow_exact=1.0000, g_deny_mutation_min=1.0000, g_margin=0.9500; dual-guard concordance 800/800; kill-gate 281/700 wrong-allows) First production-boundary integration (Prospect Q3 in a recognizable AWS-style IAM context): can a changed action be rejected after it was approved? 5-dimension IAM action tuple: principal / role / account / permission_set / condition 8 arms × 100 = 800 decisions; Arm 1 exact match (ALLOW), Arms 2–8 mutations (role escalation, principal/account swap, permission expansion, condition strip, multi-dim tamper, confusable near-match — all DENY) Dual independent guards (V1 JavaScript + V2 Python), exact code-point equality, fail-closed Preregistered → LOCKED (MANIFEST.txt) → executed post-lock; locked files verified unchanged Honest bounds: Classical software test of authorization control logic. Working-example evidence only — does not legally validate any patent claim or certify RF-100 conformance. Published under the Remnant Fieldworks Standing Covenant. To God be the glory. Proof Before Power. Verification Before Execution.