service control policy

term

cloudsecurity

Organization-level guardrails that bound what any account may ever do - ceilings on permissions that even administrators cannot exceed.

Not a grant but a boundary: the org says 'no one deletes audit logs', and no local admin can.