public sealed class ExplainedDenyPolicy : IMessage<ExplainedDenyPolicy>, IEquatable<ExplainedDenyPolicy>, IDeepCloneable<ExplainedDenyPolicy>, IBufferMessage, IMessage
Reference documentation and code samples for the Policy Troubleshooter v3 API class ExplainedDenyPolicy.
Details about how a specific IAM deny policy [Policy][google.iam.v2.Policy]
contributed to the access check.
public DenyAccessState DenyAccessState { get; set; }
Required. Indicates whether this policy denies the specified permission
to the specified principal for the specified resource.
This field does not indicate whether the principal actually has the
permission for the resource. There might be another policy that overrides
this policy. To determine whether the principal actually has the
permission, use the overall_access_state field in the
[TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
The relevance of this policy to the overall access state in the
[TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
If the sender of the request does not have access to the policy, this field
is omitted.
public RepeatedField<DenyRuleExplanation> RuleExplanations { get; }
Details about how each rule in the policy affects the principal's inability
to use the permission for the resource. The order of the deny rule matches
the order of the rules in the deny policy.
If the sender of the request does not have access to the policy, this field
is omitted.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eExplainedDenyPolicy is a class within the Policy Troubleshooter v3 API, detailing how a specific IAM deny policy contributes to an access check.\u003c/p\u003e\n"],["\u003cp\u003eThis class inherits from \u003ccode\u003eobject\u003c/code\u003e and implements several interfaces including \u003ccode\u003eIMessage\u003c/code\u003e, \u003ccode\u003eIEquatable\u003c/code\u003e, \u003ccode\u003eIDeepCloneable\u003c/code\u003e, and \u003ccode\u003eIBufferMessage\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIt contains properties like \u003ccode\u003eDenyAccessState\u003c/code\u003e, which indicates whether a policy denies a permission, \u003ccode\u003ePolicy\u003c/code\u003e, representing the IAM deny policy itself, and \u003ccode\u003eRelevance\u003c/code\u003e, which signifies the policy's importance to the overall access state.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eRuleExplanations\u003c/code\u003e property provides details on how each rule within the policy impacts a principal's inability to use a permission for a particular resource.\u003c/p\u003e\n"],["\u003cp\u003eTwo constructors are available for creating an instance of ExplainedDenyPolicy, either with no parameters or by copying an existing ExplainedDenyPolicy object.\u003c/p\u003e\n"]]],[],null,["# Policy Troubleshooter v3 API - Class ExplainedDenyPolicy (1.2.0)\n\nVersion latestkeyboard_arrow_down\n\n- [1.2.0 (latest)](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy)\n- [1.1.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.1.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy)\n- [1.0.0](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/1.0.0/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy) \n\n public sealed class ExplainedDenyPolicy : IMessage\u003cExplainedDenyPolicy\u003e, IEquatable\u003cExplainedDenyPolicy\u003e, IDeepCloneable\u003cExplainedDenyPolicy\u003e, IBufferMessage, IMessage\n\nReference documentation and code samples for the Policy Troubleshooter v3 API class ExplainedDenyPolicy.\n\nDetails about how a specific IAM deny policy \\[Policy\\]\\[google.iam.v2.Policy\\]\ncontributed to the access check. \n\nInheritance\n-----------\n\n[object](https://learn.microsoft.com/dotnet/api/system.object) \\\u003e ExplainedDenyPolicy \n\nImplements\n----------\n\n[IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage-1.html)[ExplainedDenyPolicy](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy), [IEquatable](https://learn.microsoft.com/dotnet/api/system.iequatable-1)[ExplainedDenyPolicy](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy), [IDeepCloneable](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IDeepCloneable-1.html)[ExplainedDenyPolicy](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3.ExplainedDenyPolicy), [IBufferMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IBufferMessage.html), [IMessage](https://cloud.google.com/dotnet/docs/reference/Google.Protobuf/latest/Google.Protobuf.IMessage.html) \n\nInherited Members\n-----------------\n\n[object.GetHashCode()](https://learn.microsoft.com/dotnet/api/system.object.gethashcode) \n[object.GetType()](https://learn.microsoft.com/dotnet/api/system.object.gettype) \n[object.ToString()](https://learn.microsoft.com/dotnet/api/system.object.tostring)\n\nNamespace\n---------\n\n[Google.Cloud.PolicyTroubleshooter.Iam.V3](/dotnet/docs/reference/Google.Cloud.PolicyTroubleshooter.Iam.V3/latest/Google.Cloud.PolicyTroubleshooter.Iam.V3)\n\nAssembly\n--------\n\nGoogle.Cloud.PolicyTroubleshooter.Iam.V3.dll\n\nConstructors\n------------\n\n### ExplainedDenyPolicy()\n\n public ExplainedDenyPolicy()\n\n### ExplainedDenyPolicy(ExplainedDenyPolicy)\n\n public ExplainedDenyPolicy(ExplainedDenyPolicy other)\n\nProperties\n----------\n\n### DenyAccessState\n\n public DenyAccessState DenyAccessState { get; set; }\n\nRequired. Indicates whether *this policy* denies the specified permission\nto the specified principal for the specified resource.\n\nThis field does *not* indicate whether the principal actually has the\npermission for the resource. There might be another policy that overrides\nthis policy. To determine whether the principal actually has the\npermission, use the `overall_access_state` field in the\n\\[TroubleshootIamPolicyResponse\\]\\[google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse\\].\n\n### Policy\n\n public Policy Policy { get; set; }\n\nThe IAM deny policy attached to the resource.\n\nIf the sender of the request does not have access to the policy, this field\nis omitted.\n\n### Relevance\n\n public HeuristicRelevance Relevance { get; set; }\n\nThe relevance of this policy to the overall access state in the\n\\[TroubleshootIamPolicyResponse\\]\\[google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse\\].\n\nIf the sender of the request does not have access to the policy, this field\nis omitted.\n\n### RuleExplanations\n\n public RepeatedField\u003cDenyRuleExplanation\u003e RuleExplanations { get; }\n\nDetails about how each rule in the policy affects the principal's inability\nto use the permission for the resource. The order of the deny rule matches\nthe order of the rules in the deny policy.\n\nIf the sender of the request does not have access to the policy, this field\nis omitted."]]
