Advanced AI Prompt for GCP IAM Deny Policy for Resource Protection

Act as a Google Cloud Security Architect. Create a GCP IAM Deny Policy formatted in YAML. The policy must explicitly deny the principal '[PRINCIPAL_EMAIL]' from executing any deletion operations on [RESOURCE_TYPE] (e.g., `compute.instances.delete`) within the project [PROJECT_ID]. Explain how this Deny policy overrides any existing 'Allow' policies (even if the user possesses the primitive `roles/owner` or `roles/editor` roles). This is critical for protecting high-value stateful resources from accidental or malicious destruction. Ensure the `deniedPermissions` list is exhaustively defined for the lifecycle deletion of that specific resource type.