> Don’t do this! Any principal in your management account, by default, is able to assume the OrganizationAccountAccessRole in each and every one of the accounts created using the organizations:CreateAccount API.

I should note that if you use AWS Control Tower Account Factory to create the member accounts then this role does not get created.

The "Audit" account that is created by Control Tower is probably the best one to serve as the Administrative Access Account