2.1.1. Resource Hierarchy and Organization Policies
💡 First Principle: Building a resource hierarchy is an act of translating your company's actual structure (departments, environments, cost centers) into containers that inherited policy can flow through — get the mapping wrong and you'll either over-restrict teams that needed autonomy or under-restrict ones that needed guardrails.
Creating the hierarchy typically means standing up Folders that mirror organizational reality — often one folder per department, or one per environment tier (production, staging, development) — and placing Projects inside them. Organization Policies are then applied at whichever level makes sense: a policy restricting external IP creation might apply org-wide for a security-conscious company, while a policy allowing it might be scoped down to just a "sandbox" folder for experimentation. Because policies are inherited downward, a restriction set on a Folder automatically applies to every Project nested inside it, without needing to be repeated per-project.
A standalone organization — one created without going through Google Workspace or Cloud Identity federation from an existing domain — is a valid setup path when a company wants an Organization node's structural benefits (centralized policy, folder hierarchy) without adopting Google's identity products wholesale.
⚠️ Exam Trap: IAM answers "who can do what," while Organization Policy answers "what configurations are allowed at all," even for someone with the Owner role. A scenario where a project Owner still can't perform an action they should otherwise be permitted to do is almost always pointing at an Organization Policy constraint set higher in the hierarchy — not a missing IAM grant.
Reflection Question: A security team wants to guarantee that no VM anywhere in the company can ever be created with a public IP address, without having to remember to configure that restriction on every new project going forward. Where in the hierarchy should that policy be applied, and why does that placement guarantee future projects inherit it automatically?
