A permissions boundary is an AWS guardrail attached to an IAM user or role that defines the maximum permissions that identity can ever have. It does not grant access by itself; instead, it limits what identity-based policies can allow. If an administrator later attaches a broader policy, the boundary still caps the result.
This matters in cloud security because privilege escalation often happens when a limited principal can edit policies, attach roles, or pass permissions to a service. A boundary helps reduce the blast radius of those changes by preventing an identity from growing beyond its approved ceiling. Defenders use it for delegated administration, developer roles, and other accounts where access may need to expand over time, while still preserving a hard upper limit. It is a strong control, but it still works best with least privilege, role separation, and monitoring of IAM changes.