Cloud organization-level policies are powerful preventive controls. AWS Service Control Policies, Azure Policies, GCP Organization Policies, GitHub organization policies, and dozens of other policy mechanisms create hard boundaries that override permissions, block risky actions before they happen, and enforce security baselines across your entire cloud estate. They're also some of the most complex security mechanisms to understand and manage. **Turbot Guardrails provides interactive visualizations** that automatically discover your organization policies, translate them into plain language, and map them to security objectives. Security teams can see what they're preventing across all accounts, where gaps exist, and how to improve coverage without parsing JSON. ## Native Preventive Controls Are Complex Organization policies protect your cloud environment, but understanding what they actually do is very difficult. Open the AWS Organizations console and navigate to a Service Control Policy: ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyRegionRestriction", "Effect": "Deny", "NotAction": [ "a4b:*", "acm:*", "aws-marketplace-management:*", "aws-marketplace:*", "aws-portal:*", "budgets:*", "ce:*", "chime:*", "cloudfront:*", "config:*", "cur:*", "directconnect:*", "ec2:DescribeRegions" // ... 150+ more services ... ], "Resource": "*", "Condition": { "StringNotEquals": { "aws:RequestedRegion": ["us-east-1", "us-west-2", "eu-west-1"] } } } ] } ``` One policy might contain 50 statements like this. Your organization might have 20 policies attached at different levels. With 100 accounts, the effective permissions become very difficult to compute. Security teams need answers: - Which regions can production accounts deploy to? - What services are restricted in development? - Where do multiple policies conflict? - Which accounts have exceptions we granted months ago? Getting these answers means opening policy JSON in one tab, navigating organizational units in another, checking attachments in a third, switching between accounts, viewing inherited policies, and mentally computing policy intersections. With 50 accounts and 10 policies, teams give up. ## Prevention Objectives: What You're Preventing Guardrails organizes preventive controls around security [objectives](https://turbot.com/guardrails/docs/prevention/objectives). Each objective represents a specific security goal like restricting AWS resources to approved regions, preventing public S3 buckets, or requiring encrypted EBS volumes. Objectives have [priorities](https://turbot.com/guardrails/docs/prevention/objectives/priorities) (P1 for essential controls through P5 for hygiene) and [categories](https://turbot.com/guardrails/docs/prevention/objectives/categories) (Core Infrastructure, Data Governance, Identity & Access). Take a common scenario: **restricting AWS operations to approved regions**. This is a P1 objective in the Core Infrastructure category. Organizations restrict regions for data residency compliance, cost optimization, and reducing attack surface. Objectives view showing prevention goals with coverage status and scores

Objectives view showing prevention goals with coverage status and scores

Prevention objectives show what you're protecting and how many controls enforce it

The objective view shows you have **3 active preventions** enforcing this restriction. These three policies span 22 accounts across your organization. You can see which accounts have coverage, search accounts, and identify gaps. Each objective has a [prevention score](https://turbot.com/guardrails/docs/prevention#prevention-scores) indicating coverage strength. This answers the first question: "What am I preventing?" The objective level gives you the security goal without requiring you to parse policy JSON. ## Prevention Rules: The Policies That Enforce It Guardrails discovers every preventive control deployed in your environment: AWS SCPs, Control Tower controls, Resource Control Policies, Azure Policies, GitHub organization policies, CloudFormation hooks, and account-level defaults. Each discovered policy becomes a [prevention](https://turbot.com/guardrails/docs/prevention/preventions) rule with plain language translation.

Prevention rules list showing the 3 active preventions enforcing the region restriction objective

The 3 active prevention rules enforcing the region restriction objective

For the region restriction objective, you see three prevention rules working together across different account scopes. Click into one to see the full detail: **AWS SCP Deny Statement**: "Restrict AWS Operations to Approved Regions in SCP Region-Restriction-Workload"

Prevention rule detail showing policy JSON, accounts in scope, and relationship graph

Drill into a rule to see the policy JSON, accounts covered, and where it's attached

The rule detail shows: - **Plain language summary**: This policy restricts all AWS operations to specific approved regions, denying any actions outside these regions - **The actual policy JSON**: The full SCP with all conditions and exceptions - **Accounts in scope**: The 2 accounts this policy protects - **Which objective it satisfies**: Links back to the "Restrict AWS resources to allowed regions" objective - **Relationship graph**: Where the policy is attached in your organizational hierarchy You can filter prevention rules by [layer](https://turbot.com/guardrails/docs/prevention/preventions/layers) (Build, Access, Config, Runtime), category, priority, or account. Search for specific controls. The visualization connects the policy JSON to what it actually accomplishes. ## Policy Relationship Graph The prevention rule detail includes a relationship graph for each policy. But you can also [view the relationship graph as a standalone visualization](https://turbot.com/guardrails/docs/prevention/accounts/visualize) to understand your entire organizational hierarchy with policy attachments, inheritance chains, and blast radius across all policies.

Policy relationship graph showing organizational hierarchy with search and highlighting capabilities

Search for policies and see which accounts they protect (here searching "IMDS" highlights the SCP attached to specific accounts)

This view answers questions that are difficult to piece together from the AWS Organizations console: - Where is each policy attached? (Root, OU, specific accounts) - Which accounts inherit which policies? - How many policies does each account inherit from parent OUs? - Where do policies overlap or conflict? - What's the blast radius if I modify or attach a policy? Expand organizational units to see accounts and their SCP associations. Search for specific policies (like "IMDS" in the example) and the graph highlights the related SCPs and the accounts they protect. Hover over any account to see which policies apply. The visual layout makes inheritance and blast radius clear without context switching between console screens. ## Interactive Reports: Spotting Discrepancies Guardrails provides [interactive reports](https://turbot.com/guardrails/docs/prevention/dashboard/reports) that visualize preventive control posture across accounts. The Region Boundary Report shows the region restriction scenario across all accounts:

AWS Region Boundary Report showing matrix of accounts and their regional restrictions

Spot discrepancies across accounts at a glance

The report shows **2 discrepancies found across 22 accounts**. The preventive controls restrict regions, but in 2 accounts eu-west-1 is allowed when it shouldn't be. The report marks these with X's. Other accounts show green, correctly restricted. Search, filter by status and region. Similar reports visualize service boundaries, configuration requirements, and other common preventive controls. These views surface the exceptions and anomalies that would stay hidden in policy JSON: the temporary exception granted 18 months ago that never got revoked, the accounts with conflicting inherited policies, the gaps where security tooling should be enabled but isn't. ## See it in action Watch this demo to see how Turbot Guardrails visualizes preventive policies.

## From Complexity to Clarity Cloud organization-level policies are complex - nested JSON, multiple statements, inheritance chains, and the gap between syntax and security objectives. But security teams no longer need to mentally compute policy intersections across organizational hierarchies. Start with objectives to see what you're protecting. Drill into prevention rules to see policies and accounts they cover. View the relationship graph to understand where policies attach. Use interactive reports to spot discrepancies and exceptions. These visualizations bridge the gap between complex policy syntax and security outcomes. Interested in running this in your environment? [Connect with us](https://turbot.com/start) to get your free preventive security posture assessment and start visualizing your organization's preventive policies.

Discover, analyze and visualize your preventive posture