AmazonSSMManagedInstanceCore: Full Policy Breakdown

What AmazonSSMManagedInstanceCore actually permits, when to use it for Session Manager, and how to build a scoped-down custom policy for production.