SSO : write a permission that limit actions to all accounts in OU

Hello.

As far as I know, I don't think it's possible to allow an IAM identity center user to perform actions only on a specific OU.
IAM identity center users are allowed to perform actions on the AWS accounts they have been granted access to.
Therefore, I think it would be a good idea to not link the IAM identity center user to any AWS account other than the required AWS account.
https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html