Restrict identities with domain-restricted sharing

• https://docs.cloud.google.com/organization-policy/restrict-domains

• iam.allowedPolicyMemberDomains

gcloud organizations [ add-iam-policy-binding | list | describe ], gcloud org-policies