IAM limitations