name: projects/874044958877/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
    # “enforce: false” turns the constraint OFF at this project level
    - enforce: false