How would you structure cloud accounts for a growing engineering organization?

Use many accounts as isolation boundaries rather than one big account with tags. Separate environments so production is its own account per workload or domain, keep shared services such as networking, logging and identity in dedicated accounts, and group them under an organization with service control policies as guardrails. Automate account creation from a baseline so every new account arrives with logging, guardrails and network configuration already applied.

I treat the account as the strongest isolation boundary available, so I use a lot of them rather than trying to separate things with tags and policies inside one. Production gets its own account per workload or per domain, so a mistake in one place cannot reach another and service quotas do not get shared with a noisy neighbor. Non production is separate again, which lets me give developers far more freedom there without it touching production. Then a small set of shared accounts: one for networking so the transit hub and connectivity live in one place, one that receives all logs and is write only for everyone else so an attacker in a workload account cannot erase the evidence, and one for identity and single sign on. All of it sits under an organization with service control policies as guardrails, denying things like turning off audit logging or spinning up in unapproved regions, which is different from permissions because it caps what anyone including an administrator can do. And account creation is automated from a baseline, because handmade accounts drift immediately and nobody remembers which ones missed a control.