Where Does Judgment End and Runtime Policy Begin?

AWS introduced something this week that is close enough to the problem I have been working on that I...