Your company has an organization node with three folders (Dev, Staging, Prod) and dozens of projects distributed across them. The security team wants a single IAM binding that grants their group the Security Reviewer role across every existing project and any project created in the future, with the least administrative effort. Where should you apply the IAM binding?