Who should be able to enforce rules across all projects, such as allowed regions?
Why D is the answer
Administrators, using organization policies
Organization policies let administrators enforce rules, such as allowed regions, across every project.
In detail
- Organization policies enforce rules across projects.
- IAM says who may act, and organization policies say what is allowed.
Use case
An illustrative scenario, not a real incident.
A company must keep all resources in the EU. An administrator sets an organization policy, and each project inherits it.
See it in different ways
flowchart TD A["Protect data"] --> B["Cloud IAM and organization policies"] A --> C["Encryption and key management"] A --> D["Cloud DLP for personal data"] A --> E["Regional storage for sovereignty"]
mindmap
root((Governance))
Location
Regional storage
Organization policies
Protection
Cloud DLP
Data masking
Separation
Project per environment
Ownership
Federated governanceflowchart TD
Q{"What do you want to limit?"}
Q -->|"Who may act"| A0["Cloud IAM"]
Q -->|"What is allowed anywhere"| A1["Organization policies"]Key point: Organization policies set company-wide rules.
Why the other options are wrong
- A. Each analyst, using a personal note
- A note enforces nothing.
- B. Developers, using comments in pipeline code
- A comment enforces nothing.
- C. Dashboard users, using report filters
- Report filters only affect a report.