A child can only restrict further, never loosen a parent.
Org policies control what's allowed to exist, regardless of who's asking — even a project owner can't override an active constraint.
1
Org constraint set"No public IPs on VMs" — enforced org-wide
2
Folder — no overrideNo additional constraint, so it inherits as-is
3
Project — inheritsCan add stricter rules, never loosen this one
4
Create-VM requestPublic IP request → DENIED
Common early-set constraints
✓
compute.vmExternalIpAccess — blocks default public IPs✓
iam.disableServiceAccountKeyCreation — blocks long-lived key files✓
gcp.resourceLocations — restricts approved regions✓
compute.requireOsLogin — forces IAM-based SSHA constraint added after a violation exists doesn't retroactively fix it — a stray bucket outside an approved region kept costing money for four months after the "fix" shipped.