A US federal contractor must run a new workload in Google Cloud that handles Controlled Unclassified Information (CUI). Compliance requires that the data remain within US regions, that only US-based Google support personnel who have passed government background checks can access the environment, and that the control package aligns with the DoD Impact Level 4 (IL4) framework. The security team wants Google to enforce these constraints programmatically at folder creation rather than relying on manually applied org policies. What should they do?