Comment by Moissanite

Can you give an example? Everything I can think of is either default-deny or minimally scoped, and "system" IAM roles tend to just not exist until you need them for the first time.