The places I've worked just control that with SSO and groups in their auth system. Much easier to make a group in your auth software than try to create multiple permission boundaries in the same AWS account. It also makes cost allocation much easier (you don't need complicated tagging policies everywhere)
The main risk is hitting resource limits which is why I would and do give development teams their own account to cause mayhem in.