---
title: "Block dangerous actions for the whole · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails
updated: 2026-10-20
licence: "All rights reserved"
---

# Block dangerous actions for the whole organization

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)
- Rule: Set organization-wide policies that refuse the most dangerous actions in every account, even for admins.
- How: Use the cloud's organization policies, such as AWS service control policies, Google Cloud organization policies or Azure Policy. Deny turning off or deleting the audit trail, leaving the organization, and using regions outside the list. Block public storage and service account keys. Keep a short exception for the break-glass role. Apply them from code in the management account. AWS service control policies do not bind the management account itself, so run no workloads there.
- Check: In a sandbox account, an admin tries to stop the audit trail and to start a server in a region outside the list. Both calls end in AccessDenied.

Example:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ProtectAuditTrail",
      "Effect": "Deny",
      "Action": ["cloudtrail:StopLogging", "cloudtrail:DeleteTrail", "organizations:LeaveOrganization"],
      "Resource": "*",
      "Condition": { "ArnNotLike": { "aws:PrincipalARN": "arn:aws:iam::*:role/break-glass" } }
    },
    {
      "Sid": "AllowedRegionsOnly",
      "Effect": "Deny",
      "NotAction": ["iam:*", "organizations:*", "sts:*", "support:*", "cloudfront:*", "route53:*"],
      "Resource": "*",
      "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["eu-north-1", "eu-west-1"] } }
    }
  ]
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails`.

- Previous: [Test your own rules against the plan](https://agentwranglers.se/playbook/infrastructure/policy-as-code/policy-on-the-plan)
- Next: [Let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions)
- [Policy as code](https://agentwranglers.se/playbook/infrastructure/policy-as-code)