Concepts
A policy is a set of statements: Effect (Allow or Deny), Action (for example cdn:PurgeCache or mail:ManageMailboxes), Resource (a WRN or *) and an optional Condition. An explicit deny always wins and anything not allowed is denied. Organization roles (owner, admin, operator, viewer) remain; IAM adds finer access.
Members and groups
In the console → Identity → IAM the Members tab shows each member’s attached policies and groups. Prefer attaching policies to groups (for example “DevOps team”) and moving members, so access changes in one place.
Create a policy
“New policy” opens a step editor: pick a service, tick actions, scope the resource and optionally add an IP condition (for example 185.1.2.0/24) or a time window. For secure access, allowed SSH commands and the kubectl level are set here too. A JSON mode allows direct editing.
Managed policies
Policies prefixed wc: (such as wc:ReadOnly or wc:MailAdmin) are maintained by WhyCloud and updated as actions are added. Attach them directly or copy one as a starting point.
Simulator
Before applying, pick a member, an action and a resource in the simulator; it shows the decision and the exact statement that made it.