Stark Industries uses AWS Organizations with a Production OU and deny list SCPs to manage access, and after acquiring Wayne Enterprises, the new team discovers they cannot update AWS Config rules due to existing policies. Which option allows Wayne Enterprises administrators to make necessary changes while maintaining Stark Industries' policies without requiring ongoing maintenance?