How to setup Dev Test Prod AWS ENVs same Organization

Question

I am switching between different AWS environments by using the IAM role.
The three environments that I have assumed responsibility for are Dev, Test, and Prod.
The same permissions apply to those assumed roles, including EC2, S3,...

How therefore can I utilise IAM Policy to prevent users from touching the Prod role who trust the development and test roles? I make an effort to limit using the services' tags.
Is it the best course of action? Do you have any recommendations for doing this?

        "Condition": {
            "ForAllValues:StringEquals": {
                "aws:Environment": [
                    "dev",
                ]
            }
        }

Thanks in advance!