As a org admin i need to onboard a new L1 client via either profile: shared VPC or peered VPC under the 3 workload folders

TBD - procedure to add a new L1 client (dev/prod/uat (ideally automated, for now yaml adjustment procedure

Keep in mind the project architecture for various types of teams
Requirements

1: Shared VPC (with service projects) - PaaS + shared FaaS
all tenants share a shared VPC host subnet
some tenants share a particular shared VPC host subnet
single tenants get their own 1:1 shared VPC host subnet
2: Mix Shared VPC + Peered VPCs
some tenants have a mix of shared
3: Peered VPCs (single tenant PaaS, IaaS, FaaS)
some tenants want their own distinct VPC with their own servless VPC endpoints

Discussion
Define L1 as a completely separate folder - a business unit or even at the level of regional offices, an L2 would be a business/project client under that (they would shared the VPC of the L1 or as a dev client have their own peered VPC (if they need something different than their inherited K8S PaaS shared VPC for example - or a serverless endpoint not in the parent VPC).

We have 2 dimensions:
1 - different divisions + sub teams + projects per team
2 - serverless FaaS/SaaS/PaaS/IaaS workloads per team ( where teams need out of the box PaaS all the way to custom serverless and IaaS VPC's of their own)

See the org/folder/project diagram at https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/architecture.md#high-level-organizational-structure
The grey workload folder root should be a forest instead of a single tree (between the shared perimiter/audit/management/security folders)