The best place to manage your resources is on the resource management page, which you can find under IAM & Admin. This page shows all the resources in an organization and lets you manage them. Let's go through an example of bringing on a new line of business to an organization. We'll start by adding a folder directly under the organization called department Y. To do this, we can just click the create folder button and type in department Y. A folder can exist under the organization or under another folder based on your organization's structure. For example, we could create production and development folders to help organize your projects further for each department. Since department Y is a new line of business, we'll create it at the organization level. Just like folders, when we create a project, we can choose a single-parent location, such as our new folder. Now that we have multiple lines of business, our shared infrastructure project should probably have its own folder. Let's create a new folder called shared infrastructure. After that, we can move the project under our new folder by using the options menu. Now our lines of business and our shared infrastructure have their own independent folders. We can also manage permissions on the right hand side for the organization, folders, and projects. Since we've just created a new folder for our shared infrastructure team, let's make sure they have project creator access to this new folder. We can select the folder and click add member. Let's add the shared-infra group and choose project creator. Now members of the shared-infra group can create projects under this folder, but it looks like everyone else in the organization can as well. That's because this permission is being inherited from the organization. We can use the toggle to see which permissions have been added directly or inherited. Since permissions are inherited, folders are also a good way to organize projects that have similar permissions requirements. Google recommends a least privilege approach, so you should only grant access to those who absolutely need it. Let's go ahead and remove the permission for everyone on the org to create projects by choosing the organization and removing that permission. Other best practices include using groups wherever possible and to test permission changes before making the actual change.