An AWS Organizations policy that defines the maximum permission boundary available to member accounts within an OU or the whole organization. It does not grant permissions by itself — it only restricts; the user/role still needs an allow IAM policy to actually take action.
A classic SAP-C02 question: an explicit deny in an SCP at the OU level blocks the action even if an allow exists in a lower-level IAM policy — deny always wins. SCPs do NOT affect the organization's management account.
Service Control Policy (SCP) is a concept that can show up on the exam. Check the full guide to see it in context.