Identity policy grants no broad manage-all permissions

resource "oci_identity_policy" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  description    = "<policy-description>"

  # Critical: restrict to a specific service family to avoid broad 'manage all-resources'
  statements = [
    "Allow group <GroupName> to manage instance-family in compartment <CompartmentName>"
  ]
}