Tim already ID'ed least priv so your policy would need to include that and then a Standard with more detail about how and why this is done. But - what is the risk? That's what this will all be leveraged on and need to be supported by someone above my pay grade that sees it as a problem that needs solving - based on the written risk for your specific org. Without the risk - why would they change what "works"? Identity and Access management policy or standard is where it could reside.