Cloud IAM systems look unified on the surface, but each service evaluates permissions differently behind the scenes. Some services require additional implicit permissions, while others enforce stricter resource-level checks.

Cross-service interactions are especially tricky. A role might have permission to read from one service but still fail when that service tries to invoke another on its behalf. These dependencies aren’t always obvious when writing policies.

Effective troubleshooting means reviewing service-specific permission requirements rather than assuming a single policy behaves the same everywhere.

Takeaway: IAM consistency requires understanding how each service enforces access, not just writing valid policies.