A healthcare company stores sensitive patient records in BigQuery and Cloud Storage. Their security team is worried that a compromised user credential or a misconfigured IAM policy could allow an insider to copy data to a personal project outside the organization. They want to create a security perimeter around these services so that data cannot be moved outside approved boundaries, even by users with valid access. Which Google Cloud capability best addresses this concern?