The goal is to start with good defaults so you don't have to think about every config detail upfront, but nothing is locked down. You can also set up approval workflows for any infrastructure changes that have cost implications before they're applied.
That being said, I know we are expensive and "don't add to bottom line" so this looks like good enough hacky kludge as anything else.