IAM Policy to Prevent Dedicated AI Cluster Creation in OCI Generative AI

Quick Answer

This policy statement works because it combines two separate mechanisms in OCI IAM, and understanding how they stack is the key to the question. The verb 'use' already does most of the work: OCI's verb hierarchy runs inspect, read, use, then manage, and 'use' grants read and update-style operations on a resource family without extending to the create or delete actions that 'manage' would allow. So granting 'use' on generative-ai-family gets the data scientists everyday access to models and endpoints, but it does not by itself hand them the ability to spin up a Dedicated AI Cluster, since provisioning that kind of resource is a higher-privilege action. The condition clause adds a second, explicit layer of control by checking request.operation against the specific operation name for cluster creation and excluding it. This matters because policy conditions let administrators fine-tune access at the level of individual API calls rather than only at the level of broad verbs, which is essential when a single resource family bundles together operations of very different sensitivity, like everyday inference use versus provisioning dedicated, billable infrastructure. When you see an exam question asking how to allow general use of a service while carving out one specific higher-privilege operation, look for an answer that pairs the least-privileged verb that still covers the required actions with a request.operation condition targeting the exact operation to exclude.