We’re tightening permissions across several AWS accounts while still letting application teams create and manage their own roles. I’m trying to work out where to put the guardrails: should an AWS Organizations SCP define what an account can never do, or should permission boundaries be the main control for delegated teams?

How do you divide those responsibilities in practice, especially when teams need room to experiment but must not grant themselves broader access?