How does the resource hierarchy in Google Cloud help organizations implement security policies?

Policies can be applied at the folder level and are inherited by projects inside the folder

Policies can only be applied to individual projects

Projects in the resource hierarchy are not affected by security policies.

Policies can only be applied at the organization level and affect all projects