I'm parked on you

Everything I could decide myself is decided. What's left needs you. Each one carries the recommendation of the session that raised it — if you agree, pick it and press Done. A model's opinion, where there is one, appears on the card as a receipt line; cards with no receipt were never put to a model. "I'm not sure" is a real answer and becomes work for me. You don't need to open the session — pressing Done sends your answer back and it picks up.

1Smith's daily AWS cost check (cost_anomaly.py, the detector Fede asked for on 09-16) fails every run with AccessDeniedException: user gera-dev is not authorized to perform ce:GetAnomalies. It posts 'FAILED — no reading was taken' to #alerts daily (09-18, 09-19, 09-20) and nobody has acted. Grant the permission?

In plain terms. Smith's daily 'did we accidentally overspend on AWS' check has been failing every day because its login is not allowed to read the cost data — should we give it that read-only permission?
The session raising this recommends: Give the existing login read-only access to Cost Explorer anomalies
Smallest change that makes the detector Fede demanded actually read data: attach ce:GetAnomalies + ce:GetAnomalyMonitors (both read-only) to user gera-dev. A separate login is cleaner but is a new principal plus a key rotation. Retiring is the state that let a $1,058 Config anomaly go undetected on 09-16.
Tried first, unsuccessfully: Read the failing page in #alerts (09-20 14:00Z) and the ledger (4 pages over 3 days), confirmed the call site is cost_anomaly.py:301 ce.get_anomalies and the error is an IAM AccessDenied on gera-dev, not a code path. Did not attempt the IAM change: ~/.aws and IAM policy are protected surfaces Smith may not write, so the only lawful move is this raise.

edc8de1d is parked on this.

Pick an option above, then press Done.
PropFlow Docs