AWS Orgs Service Control Policies and Permission Boundaries

In theory – you could setup permissions for individual identities or services, but SCP is about management delegation to individual organizations. In case of having multiple organizations, you  (can) delegate the identity and role management to individual organization (or organization unit) administrators. In this case you may want to impose some organization-wide rules of your "child" organization accounts, e.g. prevent disable logging, prevent update of roles.