The rule detects the first-time deletion of an IAM policy by an AWS identity within a rolling 7-day window, where the policy ARN contains guardrail-related keywords such as Boundary, Deny, Guardrail, Restrict, or SCP. It targets customer-managed policies deleted via AWS CloudTrail events (DeletePolicy) with a successful outcome, by principals that are not AWS services. The intent is to catch privilege-escalation attempts that remove restricted permissions boundaries or deny-based guardrails; automated IaC tooling deletions are excluded (Terraform, CloudFormation, Pulumi, Ansible) to avoid normal lifecycle management. The rule uses a near-real-time window (now-6m to now) and flags a deletion if the identity has not previously performed policy management within the prior 7 days (first observed in the history window). It leverages aws.cloudtrail.user_identity.arn as the key field to identify the deleting principal and aws.cloudtrail.request_parameters to inspect the policy ARN. A history window of 7 days is used to distinguish new credentials that might be compromised from routine changes by known administrators. Relevant investigation points include verifying the identity’s history of IAM policy management, confirming the policy’s deletion is legitimate, and checking for other privilege-escalation activity (CreatePolicyVersion, SetDefaultPolicyVersion, AttachRolePolicy, UpdateAssumeRolePolicy) in the same session. False positives include legitimate first-time deletions by new IAM admins or automation accounts; remediation includes re-applying any required permissions boundary, revoking credentials, and auditing current permissions for affected principals.