Your enterprise has a runner group named 'prod-deploy-runners' containing self-hosted runners with access to production deployment credentials. Currently the runner group is available to all repositories in the 'platform' organization. Security requires that only the 'billing-service' and 'payments-api' repositories be allowed to send jobs to these runners, and that no future repository automatically gains access. As the organization owner, what is the most appropriate configuration?