You are an enterprise administrator managing a shared pool of expensive GPU-backed self-hosted runners registered to a runner group at the enterprise level. Currently the group is configured to allow access from 'All organizations.' Finance reports that runners are being consumed by low-priority CI jobs across many teams. You need to restrict the GPU runner group so that only the 'ml-platform' and 'research' organizations can send jobs to it, while leaving the runners themselves untouched. What is the correct way to accomplish this?