[waleedlatif1]

Summary

• The VPC Service Controls helper added in improvement(credentials): hold unsaved keyless subjects so trust policies applied later still match #10011 landed between iamFailureMessage and its TSDoc, which left two stacked doc blocks on the helper and none on iamFailureMessage. This moves the doc back onto iamFailureMessage. No code change.

Type of Change

• Improvement

Testing

• Comment-only move; biome check passes on the file.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 13, 2026 11:05pm UTC

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This comment-only change appears safe to merge.

Summary

Moves the unchanged IAM refusal TSDoc onto iamFailureMessage.

• The IAM refusal note now sits above the message helper it describes.

_{Reviews (1) · Last reviewed commit: "chore(credentials): move the IAM refusal..." · Reviewed by Greptile}