public sealed class DenyPolicyExplanation : IMessage<DenyPolicyExplanation>, IEquatable<DenyPolicyExplanation>, IDeepCloneable<DenyPolicyExplanation>, IBufferMessage, IMessage
Reference documentation and code samples for the Policy Troubleshooter v3 API class DenyPolicyExplanation.
Details about how the relevant IAM deny policies affect the final access
state.
public RepeatedField<ExplainedDenyResource> ExplainedResources { get; }
List of resources with IAM deny policies that were evaluated to check the
principal's denied permissions, with annotations to indicate how each
policy contributed to the final result.
The list of resources includes the policy for the resource itself, as well
as policies that are inherited from higher levels of the resource
hierarchy, including the organization, the folder, and the project. The
order of the resources starts from the resource and climbs up the resource
hierarchy.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThis documentation details the \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e class within the Policy Troubleshooter v3 API, which is used to understand how IAM deny policies affect access states.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e class, part of the \u003ccode\u003eGoogle.Cloud.PolicyTroubleshooter.Iam.V3\u003c/code\u003e namespace, implements multiple interfaces, including \u003ccode\u003eIMessage\u003c/code\u003e, \u003ccode\u003eIEquatable\u003c/code\u003e, \u003ccode\u003eIDeepCloneable\u003c/code\u003e, and \u003ccode\u003eIBufferMessage\u003c/code\u003e, offering detailed control and inspection.\u003c/p\u003e\n"],["\u003cp\u003eKey properties of the \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e class include \u003ccode\u003eDenyAccessState\u003c/code\u003e, which determines if a principal is denied access, \u003ccode\u003eExplainedResources\u003c/code\u003e, a list of resources with evaluated deny policies, \u003ccode\u003ePermissionDeniable\u003c/code\u003e which shows whether a permission can be denied, and \u003ccode\u003eRelevance\u003c/code\u003e which dictates how relevant a deny policy result is to access.\u003c/p\u003e\n"],["\u003cp\u003eThe class offers two constructors, one default and one that accepts another \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e object, which allows for creating new instances or using one as a parameter to create another.\u003c/p\u003e\n"],["\u003cp\u003eThe API can be accessed in three versions, being 1.0.0, 1.1.0, and the latest 1.2.0.\u003c/p\u003e\n"]]],[],null,[]]
