A solutions architect needs to ensure that a specific service configuration—such as ensuring EC2 AMIs are never shared publicly—is consistently enforced across all member accounts, and remains enforced even as AWS introduces new APIs for that service. Which AWS Organizations policy type is most appropriate?