Scenario: Two application teams A, and B, use a single AMS account for their apps "AA", and "BB", respectively. Team A wants access only to resources for app "AA", and team B wants access only to resources for app "BB". How do I set that up?
Use their ITSM's tools to implement team-based access controls (TBAC). For example, you could use the AMS ServiceNow Connector App for integration with AMS APIs. Contact your CSDM for high level guidance of this implementation.