I ask about sandbox access in the first meeting with the cloud team, and I still get smirking faces. It's 2025 guys.

This is a cycle that I break literally using my company's AWS accounts, that do have sandbox access. Which is something I can do because we have relatively open, shared IP agreements with clients.

Then a back-and-forth of policy changes that takes months, when policies can be figured out with 30 min of experimentation with a sandbox.

The development team doesn't have a sandbox, so they need wide and general policies, which the cloud security team immediately rejects, because they want to see the strict policies they need. At the same time the cloud team doesn't provide sandbox access.