A grant names the Subject (dax.mercer@chronos.orbital), the Resource (s3://chronos-telemetry/bay-03/calibration/*), the Action (PutObject only, no DeleteObject or ListAllMyBuckets), and a Just-In-Time grant that ends at 20:00 UTC Friday. ReadWriteAdmin is wider than the task.