Multiple teams share one AWS account. How do you structure IAM so each team can only touch the resources they own?

Core Summary

Individual users each get their own IAM role via SSO federation, never a shared login or a long-lived access key, and permissions are grouped by team into roles scoped with resource tags rather than hardcoded ARNs. Past a certain team count, the real fix is separate AWS accounts per team, not tighter policies inside one shared account.