Cloud IAM: Reading a Policy Before You Trust It

How to read a cloud policy element by element, which wildcard combinations produce escalation or public access, and the controls that cap blast radius.