At Meridian Corp, an enterprise owner has created a security configuration at the enterprise level and applied it to all organizations. Priya is assigned the security manager role in the 'Payments' organization. She needs to create an additional organization-level security configuration that enables Dependabot version updates for repositories that handle PCI data, and apply it to those repos. However, when she attempts this, she finds she can create the org-level configuration but a subset of settings is locked and cannot be overridden. What best explains this behavior and what she can do?