A Starting Point for AWS Service Control Policies

A team opens an AWS account. They deploy everything in us-east-1. Reasonable choice. Six months later, their AWS bill has EC2 instances running in ap-southeast-1. Nobody on the team worked in that reg