Your organization enforces a custom organization policy that disables the use of Compute Engine VM...

The Google Cloud Resource Hierarchy is designed to allow inheritance with the ability to override policies at lower levels (Folders or Projects).2 This is the standard way to handle exceptions for specific business units without weakening the security posture of the entire organization.

According to Google Cloud Documentation (Understanding Hierarchy Evaluation):

"By default, organization policies are inherited by the descendants of the resource on which the policy is enforced. However, you can explicitly override a policy on a child resource (Folder or Project) by setting a new policy that either adds to or replaces the inherited values.3 This allows for granular control and exception handling."

Why this is the correct approach:

Isolation: By moving the workload to a specific folder, you isolate the exception.

Least Privilege: Only the resources within that folder gain the exception; the rest of the organization remains protected by the constraints/compute.vmExternalIpAccess constraint.

No "Bypass" Role: There is no standard IAM role that allows a user to "bypass" an Org Policy (Option A). Policies are enforced at the API level regardless of user roles.

Auditability: Having a specific folder with an override makes it easy for auditors to see exactly where and why an exception exists.