I’m consolidating reference patterns for enforceable guardrails across multi-account AWS and Azure to cut attack paths (lateral movement, privilege escalation) and would appreciate high-signal resources beyond vendor docs. Specifically comparing AWS SCPs + CloudFormation Hooks and Cloud Custodian for prevention/detection, and OPA/Gatekeeper vs Kyverno for cluster policy with drift handled via Config/Conformance Packs — any architecture papers, repos, or case studies from the last 6–12 months you trust?