There are no constraints on the allowed contents of an AWS IAM policy, and that’s too much power to give an author. I wish it were a capability-based system: whatever privileges I may have, I can pass on some or all of those, but no more.