AWS Organizations resource control policies, launched on 13 November 2024, are the resource-side counterpart of service control policies. They set the maximum permission any resource-based policy in the organization can grant, including grants to external principals and to anonymous callers, and attach to the root, an organizational unit, or an account.
Like SCPs they never grant anything, and they do not affect service-linked roles. They apply to a limited set of services, S3, STS, KMS, SQS and Secrets Manager at launch, so a resource in a service outside that list is unaffected no matter what the RCP says.
The common baseline denies access unless aws:PrincipalOrgID matches, with an exception for aws:PrincipalIsAWSService so AWS services acting on your resources are not broken. Add the RCP layer to your mental model when a bucket policy that deliberately grants a partner account stops working after an organization change and every account-level policy still looks correct.