The structure of IAM policies

The structure of IAM can be thought of as a hierarchy of rights and abilities. IAM policies are always inherited from parent resources. For example, a policy made at the project level applies to all resources under that project. Likewise, policies made at the organization level apply to all projects in that organization and all resources within those projects. Because of this, it's generally a good idea to create policies at the lowest level needed.