Thanks for sharing this perspective.

AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...