For me personally, it would be much more useful if I could play with the policies interactively - issue requests with some tagging (a special access key maybe?) and see what permissions they need, what context they have and which of them are allowed/denied by the policies. And what if I edit this part, would it affect the recorded requests?
At the moment, it usually takes me several iterations to tune the policy.
At the moment, it usually takes me several iterations to tune the policy.