Can organizational policies restrict IAM policy updates, and if so, how do I check?

Yes, organizational policies, particularly Organization Policy Constraints, can restrict IAM updates. Use the `gcloud org-policies describe` command to view the active policies for your organization. Look for constraints related to IAM, such as `iam.allowedPolicyMemberDomains` or `iam.disableServiceAccountUserImpersonation`. You may need to request changes from your organization administrator.