An organization enforces strict data residency requirements by setting the constraints/gcp.resourceLocations constraint at the organization root with allowedValues set to European regions (in:eu-locations). A specialized data science team requires an exception to deploy new resources in us-central1 within their dedicated Google Cloud project, while maintaining European region access and preventing inheritance conflicts. How should the DevOps engineer configure the organization policy on the target project to grant this exception?

Override the parent policy on the target project (replace inheritance) and define allowedValues to include both in:eu-locations and us-central1.: ### What Policy Overriding Is In the Google Cloud **Resource Hierarchy**, organization policies are inherited down the tree by default from the organization root to folders and projects. When a child node (such as a specific project) requires an exception or modification to an inherited list constraint like `constraints/gcp.resourceLocations`, administrators can configure the policy on that specific resource node to override its parent by setting `inheritFromParent: false` (replacing parent rules rather than merging). ### How It Meets The Requirements - **Preserves Base Access:** By explicitly including both `in:eu-locations` and `us-central1` in the project's `allowedValues` list, the team retains the ability to provision resources in European regions while gaining access to `us-central1`. - **Isolates the Exception:** Replacing inheritance on the project node isolates the exception strictly to that project without weakening organization-wide data governance rules. - **Maintains Compliance:** Descendant and sibling projects continue inheriting the strict organization-level constraint. ### Key Advantages and Capabilities - **Granular Exception Handling:** Allows precise, project-level deviations from broad corporate baselines without altering folder-level or organization-level rules. - **Deterministic Evaluation:** Replacing inheritance avoids unexpected interactions that occur when merging conflicting `allowedValues` or `deniedValues` lists. - **Non-Retroactive Impact:** Applying or overriding the policy only affects newly created resources, leaving existing infrastructure operational. - **Auditable Boundary:** Security and compliance teams can easily inspect project-level policy overrides in Cloud Asset Inventory or Security Command Center. ### Why This Is Optimal Replacing inheritance and providing the complete set of permitted values (`in:eu-locations` and `us-central1`) ensures deterministic control. If the administrator simply merged values, the parent policy would still restrict creation if restrictive rules conflicted.