The cdk bootstrap command will be able to be invoked as follows:

$ cdk bootstrap --permissions-boundary=arn:aws:iam::account-id:policy/policy-name-with-path

This sets the CloudFormation Execution Role up to enforce its use.

When users add:

{
  "context": {
    "@aws-cdk/core.permissionsBoundary": "arn:aws:iam::account-id:policy/policy-name-with-path"
  }
}

To their cdk.json, all Roles in all stacks will be provisioned with that permission boundary automatically.

This is a 🚀 Feature Request