1. A system, comprising a plurality of computing devices configured to implement: a plurality of resources of a provider network configurable to provide a plurality of distributed, web-accessible services to clients of the provider network, wherein each service of the plurality of services has a respective service manager configured to coordinate provision of the service; and an access manager; wherein the access manager is operable to: determine whether a mandatory access control policy document specified by a service manager of a particular service of the plurality of services applies to an administration request, wherein the policy document indicates that a permission setting associated with a particular type of administrative operation on a particular resource of the plurality of resources being used to implement at least a portion of the particular service cannot be modified by a client to whom a set of owner administrative rights to the particular resource have been granted, wherein the particular resource is allocated to the client (a) without an acquisition request for the particular resource from the client and (b) as a result of an acquisition request generated by the service manager on behalf of the client; and in response to determining that the policy document applies to the administration request, and that an evaluation of the policy document indicates that an administrative operation specified in the administration request is prohibited in accordance with the policy document, reject the administration request.