01 / What each boundary answers
Compare the decision, not the label.
Issues and governs identities, credentials, roles and application access. An IAM grant can be a necessary prerequisite for an agent to reach a service.
Evaluates the concrete operation, target, task origin and current constraints immediately before a consequential effect.
02 / Same operating case
Which request must be stopped?
A valid service token reaches a payment API, while the user task permits invoice matching only.
Evaluation exercise
Keep the agent’s IAM role fixed while switching the originating task from invoice matching to payment release. If both calls get the same result, inspect whether the payment executor sees task provenance.
03 / Architecture fit
How the controls can compose
Use IAM to establish the caller and baseline access. Pass verified identity into an action-time decision at the payment executor.
IAM products may provide fine-grained authorization; this comparison concerns which facts the specific deployment checks at the effect boundary.
04 / Evidence
Prove the decision and the effect separately.
Identity issuance, token validation, task grant, payment decision and actual settlement are separate records.
Primary sources