ines and omar sign in to the web console and are in the group console-users, which has ReadOnlyAccess. Ines has MFA; omar does not. The guardrail is drafted in ~/mfa-required.json.

1. Read the guardrail:

   sh

   runcopy

   cat ~/mfa-required.json

2. Store it as a policy named MfaRequired, and attach it to console-users.

3. Ask the simulator whether omar may list buckets in a session without MFA.

4. Ask the same about ines in a session with MFA: the value of the MFA fact is true this time.