Roll ups have their own problems. In particular, you really don't want them changing over time. I have banned all of the "managed policies" at my company because AWS is free to add new permissions and you have no way of knowing.

Well that can be solved with versioning.

Rollups can simply be a suggested collection of permissions. When they change, view a diff, and accept what you need.