To enforce a mandatory restriction across all resources deployed in the organization and its nested folders/projects, the policy should be set at the highest possible level, which is the Organization level.

The constraint constraints/gcp.resourceLocations (or similar resource location constraints) works by defining a list of allowed regions or zones. The most secure and explicit way to enforce that resources must be deployed in the EEA is to define the allowed EEA locations and apply the policy at the Organization level to ensure it covers all current and future projects and folders.