Just provide an Aws IAM type interface and everyone would be happy. Also don't charge for it, because that just states your systems literally were not designed with authorization in mind.

IAM/RBAC for members of an organization to control who can change settings, deploy scripts, add domains, etc.