public sealed class DenyPolicyExplanation : IMessage<DenyPolicyExplanation>, IEquatable<DenyPolicyExplanation>, IDeepCloneable<DenyPolicyExplanation>, IBufferMessage, IMessage
Reference documentation and code samples for the Policy Troubleshooter v3 API class DenyPolicyExplanation.
Details about how the relevant IAM deny policies affect the final access
state.
public RepeatedField<ExplainedDenyResource> ExplainedResources { get; }
List of resources with IAM deny policies that were evaluated to check the
principal's denied permissions, with annotations to indicate how each
policy contributed to the final result.
The list of resources includes the policy for the resource itself, as well
as policies that are inherited from higher levels of the resource
hierarchy, including the organization, the folder, and the project. The
order of the resources starts from the resource and climbs up the resource
hierarchy.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThe \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e class in the Policy Troubleshooter v3 API provides details on how IAM deny policies affect access.\u003c/p\u003e\n"],["\u003cp\u003eThis class is used to evaluate whether a principal is denied a specific permission on a resource, considering all relevant IAM deny policies.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e includes a list of resources with evaluated IAM deny policies, showing how each policy contributes to the final access decision.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eDenyAccessState\u003c/code\u003e property within \u003ccode\u003eDenyPolicyExplanation\u003c/code\u003e indicates the final result of whether the principal is denied access based on the policies.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ePermissionDeniable\u003c/code\u003e property shows if the permission being checked is applicable to deny policies, while \u003ccode\u003eRelevance\u003c/code\u003e shows the relevancy of the deny policy to the access state.\u003c/p\u003e\n"]]],[],null,["# Policy Troubleshooter v3 API - Class DenyPolicyExplanation (1.2.0)\n\nVersion latestkeyboard_arrow_down\n\n- [1.2.0 (latest)](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation)\n- [1.1.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.1.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation)\n- [1.0.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.0.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation) \n\n public sealed class DenyPolicyExplanation : IMessage\u003cDenyPolicyExplanation\u003e, IEquatable\u003cDenyPolicyExplanation\u003e, IDeepCloneable\u003cDenyPolicyExplanation\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Policy Troubleshooter v3 API class DenyPolicyExplanation.\n\nDetails about how the relevant IAM deny policies affect the final access\nstate. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e DenyPolicyExplanation \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[DenyPolicyExplanation](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[DenyPolicyExplanation](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[DenyPolicyExplanation](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.DenyPolicyExplanation), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.PolicyTroubleshooter.Iam.V3](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3)\n\nAssembly\n--------\n\nGoogle.Cloud.PolicyTroubleshooter.Iam.V3.dll\n\nConstructors\n------------\n\n### DenyPolicyExplanation()\n\n public DenyPolicyExplanation()\n\n### DenyPolicyExplanation(DenyPolicyExplanation)\n\n public DenyPolicyExplanation(DenyPolicyExplanation other)\n\nProperties\n----------\n\n### DenyAccessState\n\n public DenyAccessState DenyAccessState { get; set; }\n\nIndicates whether the principal is denied the specified permission for\nthe specified resource, based on evaluating all applicable IAM deny\npolicies.\n\n### ExplainedResources\n\n public RepeatedField\u003cExplainedDenyResource\u003e ExplainedResources { get; }\n\nList of resources with IAM deny policies that were evaluated to check the\nprincipal's denied permissions, with annotations to indicate how each\npolicy contributed to the final result.\n\nThe list of resources includes the policy for the resource itself, as well\nas policies that are inherited from higher levels of the resource\nhierarchy, including the organization, the folder, and the project. The\norder of the resources starts from the resource and climbs up the resource\nhierarchy.\n\nTo learn more about the resource hierarchy, see\n\u003chttps://cloud.google.com/iam/help/resource-hierarchy\u003e.\n\n### PermissionDeniable\n\n public bool PermissionDeniable { get; set; }\n\nIndicates whether the permission to troubleshoot is supported in deny\npolicies.\n\n### Relevance\n\n public HeuristicRelevance Relevance { get; set; }\n\nThe relevance of the deny policy result to the overall access state."]]
