You are overseeing the DevOps operations for a large enterprise that is shifting its data warehouse solutions to Google Cloud. You want to ensure that only authorized compute instances in your organization can access Google Cloud Storage buckets holding sensitive data. Which method should you use to enforce this policy organization-wide, following Google's best practices?