Pick actions, choose a scope, and copy the policy. Every action and ARN shape comes from the lakeFS source, so the builder warns when a scope cannot match what you selected.
No slashes, no control characters, at most 512 bytes.