Approval without broad permissions
A developer never holds provisioning rights. They request a resource through the UI, and once an admin approves, the platform provisions the stack. The permission stays with the platform; the request stays with the developer.
Templates are the review surface
Only pre-approved CloudFormation templates can be provisioned, and those templates are version-controlled in Git. A merge to develop syncs them to S3 automatically, and the system creates new folders as they are added to the repository — so adding a new provisionable resource type is a pull request, reviewed like any other change, rather than a console action nobody sees.
Custom resource tags are supported, which is what keeps the resulting resources attributable once they exist.