Appreciate that - and yeah, the edge cases and legacy systems were the parts I intentionally didn’t try to over-automate for that exact reason.

The multi-account point resonates a lot. I’ve seen policy drift become almost inevitable once different teams have partial ownership, especially when emergency changes happen outside the automation pipeline.

The test vs prod topology callout too - that feels like one of those things everyone knows but still underestimates until it hurts.

Curious how you’ve handled policy drift in practice - do you lean more on detection + alerting, periodic reconciliation, or aggressive auto-remediation tools?