A multinational enterprise uses AWS Organizations to manage several AWS accounts spread across different regions. The company's IT department centrally manages the creation of IAM roles. Recently, the company decided to delegate the IAM role creation to various regional teams to speed up the process and reduce the IT department's workload. However, it is critical to prevent privilege escalation and ensure the scope of IAM roles remains within the defined limits. Which solution will meet these requirements with the LEAST operational overhead?