An SCP allows the recovery service but blocks the dependent KMS decrypt call during restore

The incident playbook launches correctly, but restore still fails because the organization policy forgot the downstream KMS permission the service actually needs.