A company has 120 AWS accounts. Product teams own deployments, but security must prevent disabling organization audit logging. Teams still need different workload permissions. Which design best separates the organizational boundary from workload grants?

1. Attach FullAWSAccess to all roles and use SCPs as their only permission grants.
2. Use only a management-account Config aggregator to block API calls.
3. Create identical IAM users in every account and distribute one shared access key.
4. Apply scoped SCP restrictions to the relevant OUs and retain least-privilege workload IAM policies.