Advanced AI Prompt for Attribute-Based Access Control (ABAC) in AWS

Act as a Cloud Identity and Access Management (IAM) Architect. Construct an advanced AWS IAM policy implementing Attribute-Based Access Control (ABAC) to dynamically govern access to [RESOURCE_TYPE]. The policy must grant operational access *only* if the assuming principal's 'Project' tag exactly matches the target resource's '[PROJECT_TAG]' and their 'Environment' tag matches '[ENVIRONMENT_TAG]'. Utilize the dynamic variables `${aws:PrincipalTag/Key}` and `aws:ResourceTag/Key`. Crucially, include a specific statement utilizing the `iam:ResourceTag` condition to prevent users from altering tags to escalate their own privileges. Output the dynamic ABAC policy in pristine JSON format.