=== vulnerable policy block ===
        ir.command.operation_cli_name,
    )

    try:
        # Check security policy
        if READ_OPERATIONS_INDEX is not None:
            policy_decision = check_security_policy(ir, READ_OPERATIONS_INDEX, ctx)

            if policy_decision == PolicyDecision.DENY:
                error_message = 'Execution of this operation is denied by security policy.'
                await ctx.error(error_message)
                raise AwsApiMcpError(error_message)
            elif policy_decision == PolicyDecision.ELICIT:
                await request_consent(cli_command, ctx)
        else:
            if READ_OPERATIONS_ONLY_MODE:
                error_message = (
                    'Execution of this operation is not allowed because read only mode is enabled. '
                    f'It can be disabled by setting the {READ_ONLY_KEY} environment variable to False.'
=== fixed policy block ===

    try:
        # Check security policy.
        if READ_OPERATIONS_INDEX is None:
            error_message = (
                'Execution of this operation is denied because the security policy '
                'enforcement data failed to initialize.'
            )
            await ctx.error(error_message)
            raise AwsApiMcpError(error_message)

        policy_decision = check_security_policy(ir, READ_OPERATIONS_INDEX, ctx)

        if policy_decision == PolicyDecision.DENY:
            error_message = 'Execution of this operation is denied by security policy.'
            await ctx.error(error_message)
            raise AwsApiMcpError(error_message)
        elif policy_decision == PolicyDecision.ELICIT:
            await request_consent(cli_command, ctx)

        if ir.command and ir.command.is_help_operation:
=== vulnerable startup failure handling ===
    logger.info('AWS_REGION: {}', DEFAULT_REGION)

    # Always load read operations index for security policy checking
    try:
        READ_OPERATIONS_INDEX = get_read_only_operations()
    except Exception as e:
        logger.warning('Failed to load read operations index: {}', e)
        READ_OPERATIONS_INDEX = None

    if TRANSPORT == 'stdio':
        server.run(
=== fixed startup failure handling ===
        raise

    if TRANSPORT == 'stdio':
        server.run(
            transport=TRANSPORT,
        )
    else:  # streamable-http or other HTTP transports
        server.run(
            transport=TRANSPORT,
            host=HOST,
            port=PORT,
            stateless_http=STATELESS_HTTP,