A financial holding company uses AWS Organizations with 40 member accounts and must prevent data leaving its boundary, block members from opting out of AI service data protections, and still allow central security to audit all resources. Which organization policy combination should the platform team deploy to enforce these guardrails?

Resource control policies evaluate resource-based access across the organization and can enforce identity and network perimeter controls such as requiring access only from expected principals or networks, which makes them the correct mechanism for data-perimeter enforcement on resources like S3 and KMS, while AI services opt-out policies centrally govern whether AWS may use customer content for service improvement and cannot be achieved with service control policies alone. Service control policies filter allowable IAM principal actions but do not directly evaluate resource-side conditions in the same way, so using only service control policies misses the resource perimeter requirement, and tags policies standardize tagging rather than restricting access. Declarative policies configure service settings centrally but do not provide resource perimeter enforcement, and neither service control policies nor declarative policies replace the dedicated AI opt-out control, so only the resource control plus AI opt-out combination satisfies all three stated facts. For the exam remember that service control policies manage what principals can do, resource control policies manage what resources allow, and AI opt-out is its own policy type, and in practice verify inheritance and explicit denies in the management account before enforcing broadly.