The policy InvoicesRead exists. tomas is in no group; mei is in the group finance, which will grow. Both have profiles.

1. Attach InvoicesRead to tomas.

2. Read the invoice as tomas:

   sh

   copy

   aws s3 cp s3://invoices-1pju0ws/2026-09.csv 2026-09.csv --profile tomas

3. Give the whole finance team the same access, in a way that also covers whoever joins it next month. Then read the invoice as mei.

4. List the policies attached directly to mei, and compare with what mei just did.