Organisation Policies and Constraints

Organisation policies are guardrails that restrict what can and cannot be done across your GCP environment. While IAM controls who can do things, organisation policies control what can be done — regardless of IAM permissions.

---

IAM vs Organisation Policies

Aspect	IAM	Organisation Policies
Controls	Who has access	What is allowed
Mechanism	Roles and permissions	Constraints
Example	"Alice can create VMs"	"VMs can only be created in europe-west2"
Override	Cannot override with more permissions	Cannot be bypassed, even by owners

Even a user with the roles/owner role cannot violate an organisation policy.

---

How Organisation Policies Work

Organisation policies are applied at the organisation, folder, or project level and are inherited downward:

Organisation: Constraint — no public IP on VMs
  ├── Folder: Engineering
  │   └── Project: eng-prod — inherits "no public IP"
  │                           (cannot override)
  └── Folder: Sandbox
      └── Project: sandbox-1 — can be EXEMPTED by the org admin

Key Concepts