Organization Policy Service: constraints such as resource locations and disabling service account key creation

The Organization Policy Service gives administrators central guardrails. Where IAM decides who can act, an organization policy decides what configurations are allowed at all. Even a project Owner can't create a resource that an organization policy forbids. This makes organization policies the right answer whenever a requirement says something must never happen, 'even by administrators' or 'even by project owners'.