I think an analogy is trying to get a complicated IAM permissions setup just right, where you have some resource policies with NotPrincipal, some usage policies

I think an analogy is trying to get a complicated IAM permissions setup just right, where you have some resource policies with NotPrincipal, some usage policies with NotResource/NotAction, etc. It becomes really hard to think about and you often rely on assumptions about the shape/structure of IAM principals. Or, you can slap a Service Control Policy on the whole account and then boom, nobody can do Whichever Bad Thing that you're worried about Today. The former approach requires me to reload the entire graph of dependencies and assumptions into my head whenever I want to make a change or ask my mental model of it a question. The latter approach allows nearly-reflexive answers.