Hi team, I have a proposition to patch policy for security hub - github.com/cloudposse-terraform-components/aws-security-hub/pull/61

Without a condition, the delegated administrator can call

DisablePolicyType

for any policy type, including

SERVICE_CONTROL_POLICY