A SaaS startup authorizes warehouse staff via Identity Center, partner microservices via IAM roles, and connected forklifts via certificates, needs fine-grained document approvals, and wants consistent policy evaluation. Which authorization design should the architect choose for human, workload, and device access?

The design that combines Identity Center permission sets, IAM Roles Anywhere for forklift devices, and Verified Permissions with Cedar policies aligns each identity source to its purpose while centralizing fine-grained decisions. Identity Center permission sets give warehouse staff short-lived workforce access with centralized assignment; IAM roles give partner microservices workload credentials without long-lived secrets; IAM Roles Anywhere extends IAM roles to forklifts using certificates, trust anchors, and profiles; and Verified Permissions evaluates Cedar policies for document approvals consistently across services. The design that uses IAM ABAC for approvals fails conceptually because ABAC conditions enforce permissions through IAM policies and do not provide application-level, consistent evaluation with versioned policy stores and audit. The design that uses Cognito user pools for staff fails because Cognito serves external application customers, whereas Identity Center supports workforce SSO and permission-set lifecycle. The design that uses IAM instance roles for services and devices fails because instance roles deliver credentials to EC2 through IMDS and cannot validate external X.509 certificates; that requires Roles Anywhere trust anchors and profiles. Exam caveat: distinguish workforce from customer identity and EC2-only from external workload credentials, since questions may mix them. Practical check: map each actor to its credential path, then test Cedar permit and forbid decisions in the Verified Permissions policy store using representative principals and document attributes before wiring enforcement.