gcp-ci-admin-grants-dwd

Workspace super-admin can authorize any service account for Domain-Wide Delegation (adding its OAuth2 client ID to the delegated clients list with chosen scopes), creating a new tenant-wide impersonation primitive.

derived gcp emits CanModifyTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ServiceAccount`
source	`?admin`
target	`<any existing ServiceAccount in the domain that the admin can authorize for DWD>`
conditions	`service_state`
state logic	ACTIVE: a super-admin has standing capability to authorize DWD for any existing service account at any time. CONDITIONAL(service_state) if the admin account is suspended or MFA-protected in a way that prevents console access. BLOCKED if the Workspace organization has restricted DWD authorization (an org-level policy that prevents new DWD grants — available in some Enterprise configurations).

source type

Identity

target type

ServiceAccount

source

?admin

target

<any existing ServiceAccount in the domain that the admin can authorize for DWD>

conditions

service_state

state logic

ACTIVE: a super-admin has standing capability to authorize DWD for any existing service account at any time. CONDITIONAL(service_state) if the admin account is suspended or MFA-protected in a way that prevents console access. BLOCKED if the Workspace organization has restricted DWD authorization (an org-level policy that prevents new DWD grants — available in some Enterprise configurations).

Narrative

{admin.name} is a Workspace super-admin and can authorize any existing service account for Domain-Wide Delegation via the Admin console, granting it the ability to impersonate any domain user for any configured OAuth2 scopes. This is the mechanism that creates the DWD SA → CanDelegate tenant-wide primitive (rule gcp-ci-dwd-sa-delegates-user).

Raw rule rules/derived/gcp/cloudidentity.yaml

id: gcp-ci-admin-grants-dwd
emits: CanModifyTrust
description: Workspace super-admin can authorize any service account for Domain-Wide Delegation (adding
  its OAuth2 client ID to the delegated clients list with chosen scopes), creating a new tenant-wide impersonation
  primitive.
match:
- - admin: null
  - HasRole
  - admin_role: null
where:
- node_type(?admin) == HumanIdentity
- ?admin.is_super_admin == true
- ?admin.suspended == false
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: ?admin
  target: <any existing ServiceAccount in the domain that the admin can authorize for DWD>
  permissions: []
  conditions:
  - service_state
  state_logic: "ACTIVE: a super-admin has standing capability to authorize DWD for any existing service\
    \ account at any time. CONDITIONAL(service_state) if the admin account is suspended or MFA-protected\
    \ in a way that prevents console access. BLOCKED if the Workspace organization has restricted DWD\
    \ authorization (an org-level policy that prevents new DWD grants \u2014 available in some Enterprise\
    \ configurations)."
  confidence: 0.88
  derived_from:
  - 'Directory API users.list: is_super_admin=true for ?admin'
  false_positive_note: "DWD authorization requires the super-admin to actively add a client ID in the\
    \ Workspace Admin console (Admin console > Security > API controls > Domain-wide delegation). This\
    \ is an ACTIVE capability, not a passive one \u2014 the admin must take a deliberate action on each\
    \ SA. The super-admin can also revoke existing DWD grants. Model this as CanModifyTrust (the admin\
    \ can rewrite the trust configuration of any SA's DWD status), not as CanAdminister. A delegated admin\
    \ CANNOT authorize DWD \u2014 only full super-admins have this capability. Emit only when is_super_admin\
    \ is confirmed true (not merely isDelegatedAdmin). Scope the target to existing ServiceAccount nodes\
    \ in the graph, not hypothetical future SAs."
  narrative: "{admin.name} is a Workspace super-admin and can authorize any existing service account for\
    \ Domain-Wide Delegation via the Admin console, granting it the ability to impersonate any domain\
    \ user for any configured OAuth2 scopes. This is the mechanism that creates the DWD SA \u2192 CanDelegate\
    \ tenant-wide primitive (rule gcp-ci-dwd-sa-delegates-user)."