[carlospolop]

Problem

Three AWS privilege routes had generic requires.all_of checks for actions that their native preconditions already verify against the exact request and resources. The generic checks can reject a valid resource-scoped grant before the native evaluator sees it.

Change

• Let the EC2 RunInstances and Spot Instance preconditions verify each launch/request resource and exact iam:PassRole context.
• Let the Cloud Control precondition verify CreateResource, exact iam:PassRole, service trust, and the administrator-user path.
• Leave historical catalog bindings untouched in CSPM.

The route IDs, preconditions, targets, and outcomes remain unchanged. This PR removes only redundant generic gates and documents where the action checks occur.

Verification

• Existing scoped-grant, prior-binding, positive/negative native route tests are running on the matching CSPM branch.
• YAML files in both repositories are byte-identical after this change.