A company stores customer invoices in multiple Amazon S3 buckets across a single AWS account. During a recent audit, a developer accidentally attached a bucket policy that made one bucket publicly readable. The security team wants a single, account-wide control that guarantees no S3 bucket or object in the account can ever be made public via ACLs or bucket policies, regardless of what individual developers configure. Which solution meets this requirement with the least ongoing effort?