Your company is using Google Cloud. You have two folders under the Organization: Finance and Shopping. The members of the development team are in a Google Group. The development team group has been assigned the Project Owner role on the Organization. You want to prevent the development team from creating resources in projects in the Finance folder. What should you do?

The correct approach is to remove the broad Project Owner role at the Organization level and instead grant more granular permissions. By removing the Project Owner role from the Organization, you revoke the development team's ability to create resources in all folders, including Finance. Then, by assigning the Project Owner role specifically to the Shopping folder, you restore their necessary permissions for that area without affecting Finance. Assigning Project Viewer to Finance while retaining Project Owner at the Organization level (first option) would not work because the Organization-level Project Owner role would still override the more restrictive folder-level role due to IAM policy inheritance. Assigning only Project Viewer to Finance (second option) would not grant them the necessary permissions in Shopping. Assigning only Project Owner to Shopping (fourth option) would not remove their existing, overly broad permissions at the Organization level.