Your organization uses Cloud Run services in multiple projects under a non-production folder, where most services need to communicate internally. Some services require access to specific, approved fully qualified domain names (FQDNs), while other external traffic must be restricted. Internal applications must remain private. You need to implement granular control so that allowlists can override more restrictive policies for designated VPCs only. What should you do?