"Save policy failed" was, for most people who saw it, a placeholder in our own starter template that they had not noticed — and the message told them none of that.

• •Checked before submission. Account ids, ARNs and principals are validated as you write them, by the same rules on the editor and the API, so a typo is caught where you can see it rather than coming back as a failure from AWS.
• •AWS's own answer, when it is AWS refusing. A policy AWS rejects now shows what AWS said. It used to arrive as a generic server error, which read as our outage rather than your typo.
• •Risky-but-valid policies ask first. Making a bucket readable by the whole internet is a legitimate thing to do and a terrible accident. You are asked before it saves — the console only badges it afterwards. Purely informational notes never interrupt.
• •We never block a policy AWS would accept. Uncertain cases are warnings, not errors. (The validator's first week produced exactly the failure it exists to prevent, by calling a working production policy invalid. That rule is the fix.)
• •Ten copy-paste recipes are published in the docs — read-only public access, CloudFront, VPC-only, deny-unencrypted and others. Each one is checked against our own validator on every build, so a recipe we publish can never be one our editor rejects.

Every save is still kept, with a diff and one-click restore. Full details in Bucket policies.