Seems contradictory to what a vending machine is trying to do, but certain restrictions need to be in place.
Follow everything! Whatever users are allowed to do, make sure you know exactly what happened, when and where.
Minimize requirements to connect to your own production services. If your requirements include connectivity to other accounts/services, be aware of the limitations.
Allow your technology team to provision pre-approved infrastructure that meets your internal architecture, FinOps and Security requirements.