> but currently everything is done manually and it shows that doesn't work well

If it is all done manually, and there are both good and bad IAM setups, can you really extrapolate to "manual" being the root cause? How can you even get an LLM to produce secure policies without having existing secure policies to train on? The entire premiss seems off and misleading to me

I would expect a hands-off approach to have worse outcomes