Step-by-step structure

Wildcard action identification

Wildcard resource identification

Privilege escalation path

Named standard reference

Condition key recommendation

Resource scoping recommendation

Severity rating

Specific remediation

Valid JSON policy

Version field present

No placeholder values

Specific resource ARNs

No wildcard actions

Condition block included

S3 actions scoped correctly

DynamoDB actions scoped correctly

Separate statements per service

SOC2 explicit reference

Step-by-step structure

Specific gap identification

Least privilege / separation of duties

Production-ready remediation snippet

Second compliance framework

MFA or access control recommendation

Audit/logging recommendation

Actionable next steps