Advanced AI Prompt for Scoped AWS KMS Key Policy for Multi-Account Access

Act as a Cloud Cryptography Architect. Draft an advanced AWS KMS Key Policy that strictly separates administration from cryptographic usage. Grant the principal [KEY_ADMIN_ARN] full administrative rights (`kms:*`). Allow the external account [EXTERNAL_ACCOUNT_ID] to utilize the key for `kms:Encrypt` and `kms:Decrypt` operations, but *only* if the cryptographic request explicitly includes a specific `kms:EncryptionContext:[ENCRYPTION_CONTEXT_KEY]` that exactly matches '[VALUE]'. Explain in the comments how enforcing this Encryption Context mathematically ensures that even if the external account's IAM role is compromised, the KMS key cannot be utilized to decrypt ciphertexts without knowing the exact context string.