A financial services company has hundreds of Google Cloud projects across multiple departments. The central security team wants to enforce a rule that no project anywhere in the organization can create resources outside of approved regions, and they want this rule to apply automatically to any new projects created in the future without manual configuration per project. Which approach best meets this requirement?