AWS IAM role session policy shrinks access below the base role and only one Lambda path fails decrypt

The role seems correct, yet decryption still fails because the assumed session adds a restrictive inline policy at invocation time.