A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operat...

A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies.
How should a solutions architect address this issue?