No, as this is at the granting org level - so the org owner may restrict it to their domain and anyone under it won't be able to assign privileges to an identit

No, as this is at the granting org level - so the org owner may restrict it to their domain and anyone under it won't be able to assign privileges to an identity from a random domain, but that's not what this is about - If I own the org and project I can opt to not restrict the domains and invite anyone. However IIRC Owner Role grants require email invite acceptance, just not sure if that's policy driven as well - https://issuetracker.google.com/issues/111843590?pli=1 https://issuetracker.google.com/issues/111843590?pli=1