Your company has established a resource hierarchy, including a parent folder with department-specific subfolders. Each department manages its own project and VPC within its assigned folder and possesses the necessary permissions to create Google Cloud firewall rules. It's imperative that the VPCs prohibit traffic flow between them, while each department should only be responsible for managing intra-VPC firewall rules. How can you achieve this?