An organization wants to enforce that all projects under a specific folder have a set of constraints, such as disabling default network creation and requiring shielded VMs. What is the most efficient way to achieve this?