A European healthcare company is migrating to GCP. Due to strict data sovereignty laws, no data or compute resources can be deployed outside of the europe-west3 (Frankfurt) region. You need to ensure that developers cannot accidentally spin up resources in US or Asian regions. What is the most robust way to enforce this?

The Organization Policy Service gives centralized control over your organization's cloud resources. By applying the 'Resource Location Restriction' constraint at the Organization or Folder level, you create a hard boundary. Even if a user has 'Owner' permissions on a project, the API will reject any request to create a resource outside of the specified region (europe-west3).