An AWS IAM permissions boundary copied from a template blocks kms:Decrypt in the break-glass role and recovery automation fails during an incident

The emergency role exists, yet one inherited boundary quietly removes the exact permission the runbook requires.