iam

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Define the compromise scope and secret boundary, map direct and indirect capability paths, and assemble evidence with explicit assumptions. Denial tests and model refusals are useful observations, not universal proofs.