Is there a first-class way to enforce at a project config level that a stack outside the organisation should never be used?