Speaking directly to the AWS case since that's what this is about, the whole point of permission boundaries is to prevent the blast radius of your IAM policy fr

Speaking directly to the AWS case since that's what this is about, the whole point of permission boundaries is to prevent the blast radius of your IAM policy from being too wide. Coupled with service control policies ("thou shalt not" at an account level), I wonder why you'd need a manual review of your IAM policies. Unless it's a "we didn't know you could do that! time to stiffen up our policies" meeting, which seems weird. Having templates is useful though so you know what you need to define for your policies inside your boundaries.