Conciseness

The body is a lean catalog of corrections Claude cannot reliably recall from pre-training — 'AcceptHandshake/DeclineHandshake logged in ACTING account ONLY', 'DuplicatePolicyAttachmentException (not PolicyAlreadyAttachedException)', 'Role chaining: max 1-hour session' — with zero padding and no explanation of IAM basics. Every bullet earns its place, matching the 5 anchor.

Actionability

Guidance is concrete and executable: exact API and exception names, a runnable CLI command ('aws organizations list-available-policy-types'), exact boto3 methods ('activate(), deactivate(), delete() — NO update()'), a complete copy-paste JSON policy for the ForAllValues/Null pattern, and documentation URLs. For an instruction/corrections skill this matches the 5 anchor; only one bullet ('waiter + time.sleep(10) pattern') is hint-style, which is not enough to drop to 4.

Workflow Clarity

'Common Workflows' provides clear conditional routing ('Read references/aws-iam-role-management.md if the user needs to create, scope, or maintain IAM roles') and the destructive account-closure case has explicit ordering ('Remove FIRST, then close'), but validation checkpoints are implicit in the body — the actual multi-step workflows and their verification steps live in the reference files. This sits between anchors 3 and 4, closer to 4: routing is unambiguous but body-level checkpoints are missing.

Progressive Disclosure

SKILL.md is a proper overview with well-signaled, condition-gated references to two files, but the bundle contains two more files (references/common-pitfalls.md and references/service-authorization.md) that are only discoverable via second-level links inside aws-iam-policy-generation.md, and the ForAllValues Null-check pattern is duplicated between the body and common-pitfalls.md. This matches anchor 4 ('most content appropriately placed; minor organization gaps') rather than 5's fully one-level-deep structure.

Specificity

The description lists many concrete capabilities — 'verified corrections for IAM behaviors... policy evaluation edge cases, trust policy gotchas, STS session limits', 'condition operator safety (ForAnyValue/ForAllValues with Null checks)', 'confused deputy protection', and 'service role creation... with aws:SourceAccount/aws:SourceArn trust conditions' — comprehensive and entirely free of vague language. It exceeds the 4 anchor ('several specific actions; minor gaps') because coverage spans corrections, workflows, and generation with no apparent gap.

Completeness

It explicitly answers both questions: 'what' via three sentences of concrete capabilities and 'when' via the explicit 'Applies when...' trigger clause, and even adds scope boundaries ('Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC'). This is a direct match for the 5 anchor; the 4 anchor's 'when could be more explicit' does not apply.

Trigger Term Quality

The 'Applies when' clause uses natural phrases users would say — 'creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role' — including synonyms (IAM/bucket policies, service/execution role). This matches the comprehensive-synonyms anchor; score 4 would require noticeably missing common terms, which is not the case.

Distinctiveness Conflict Risk

It occupies a clear AWS IAM niche with distinct triggers (IAM roles, bucket policies, STS, Organizations, Terraform plan JSON) and explicitly excludes adjacent domains ('Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC'), minimizing overlap with security or Terraform-generic skills. Score 4's 'minor overlap risk with closely related skills' is not evidenced.