Many teams create multiple GCP projects and each project needs specific access. Central IT must access all projects and Cloud Storage/BigQuery data must be shared ad hoc. To minimize IAM policies, which two steps should you take?

Introducing a resource hierarchy (folders/organizations) allows you to apply IAM policies at a higher level, and these policies are inherited by all resources within that hierarchy. This significantly reduces the number of individual policies needed. Creating distinct groups per team and referencing these groups in IAM policies simplifies management because you only need to update the group membership, not individual policies, when team members change. Using service accounts for sharing data is not a general solution for minimizing IAM policies across projects. Enumerating projects and users for each resource would lead to a large number of complex, difficult-to-manage policies, directly contradicting the goal of minimizing them.