Question on file server best practices

Howdy all, I hope your week is off to a good start. I was raging against the mess of file permissions in some of the client environments I support, and wondered if there's a better way.

The environments I work in are almost entirely Windows-based. I know the standard best practice is to assign file permissions by security groups, and that's all fine and dandy. What I'm curious about is if there is any mechanism that would enforce a policy of just not allowing permissions to be assigned to user accounts? E.g., a helpdesk staffer tries to add a single user to a folder via the security properties, and is not permitted to do so?

I know this sounds like a policy problem looking for a technical solution, but I have no power either way and just had this idle question.