The correct choice is AWS Organizations. Service Control Policies let you centrally define the maximum permissions for member accounts and they enforce those limits even if administrators in those accounts try to grant broader access.

SCPs attached through AWS Organizations can deny entire services, specific resources, or particular API actions and they act as a permission ceiling that local IAM policies cannot exceed. This central control is what the security team needs to ensure consistent guardrails across all 90 accounts.

AWS Control Tower helps set up and govern a multi account landing zone and it applies higher level guardrails, but it builds on features such as SCPs and AWS Config. It is not the direct mechanism for capping API operations across accounts.

AWS Firewall Manager focuses on network and perimeter protections such as WAF rules and Shield protections and it does not control IAM permissions or block API actions across accounts.

AWS Identity Center provides centralized authentication and access assignments for accounts and it does not impose organization wide permission ceilings that prevent specific API calls in member accounts.

Full AWS Practitioner Certification Question