Which approach should be used to govern Vertex AI in a business unit, including predefined and custom organization policies and modules scoped to the business unit folder?

• A. Implement Assured Workloads with a folder and relevant control package.
• B. Implement preconfigured and custom organization policies applied to the folder.
• C. Create a policy bundle using Rego and implement via Workload Manager scoped to the folder.
• D. Create a posture consisting of predefined and custom organization policies and predefined and SHA custom modules scoped to the business unit folder.

Answer: (D)

Governing Vertex AI with a posture that combines predefined and custom organization policies plus predefined and custom modules, all scoped to the business unit folder, gives you a cohesive, reusable, and boundary-aware governance scheme. This approach packages both the guardrails (organization policies) and the enforcement logic (policy modules) into a single, versionable artifact that can be applied consistently across all Vertex AI resources within that business unit, while remaining isolated from other units. It enables you to tailor controls to the unit’s specific needs without sacrificing the common safety net provided by standard policies, and it supports growth by allowing you to add or adjust modules and policies as requirements evolve. Other approaches either rely only on static policies without modular enforcement, or rely on external tools that aren’t as tightly integrated or scoped to the business unit’s folder, making them less scalable and harder to manage.