gcp-ci-super-admin-controls-org

id: gcp-ci-super-admin-controls-org
emits: CanGrantPermission
description: Workspace super-admin can grant any GCP IAM role to any principal in the linked GCP organization,
  equivalent to resourcemanager.organizations.setIamPolicy.
match:
- - user: null
  - HasProperty
  - org_linkage: null
where:
- node_type(?user) == HumanIdentity
- '?user.is_super_admin == true   # isAdmin=true from Directory API users.list'
- ?user.suspended == false
- '?org_linkage exists   # GCP-Workspace org linkage verified'
emit:
  source_type: Identity
  target_type: Identity
  source: ?user
  target: <any principal (Identity, ServiceAccount, Group) in the linked GCP Organization>
  permissions:
  - resourcemanager.organizations.setIamPolicy
  conditions: []
  state_logic: ACTIVE when GCP-Workspace org linkage is confirmed AND user.is_super_admin==true AND user.suspended==false.
    CONDITIONAL(service_state) if org linkage is unverified or the user account is suspended. BLOCKED
    if an IAM deny policy at the org level explicitly denies resourcemanager.organizations.setIamPolicy
    for the super-admin.
  confidence: 0.92
  derived_from:
  - 'Directory API users.list: isAdmin=true for ?user'
  - 'GCP-Workspace org linkage: resourcemanager.organizations.get -> displayName matches customer domain'
  false_positive_note: "Distinguish super-admin (isAdmin=true) from delegated admin (isDelegatedAdmin=true)\
    \ \u2014 they have very different privilege levels. A delegated admin does NOT have implicit org IAM\
    \ write unless their admin role specifically grants it. Verify the GCP organization is actually linked\
    \ to the Workspace customer before emitting; a standalone Cloud Identity customer without a GCP org\
    \ linkage is narrower in scope. The super-admin's GCP org control requires them to first navigate\
    \ to Cloud Console or call the Resource Manager API \u2014 it is not granted automatically without\
    \ action, but the capability is real and standing."
  narrative: "{user.name} is a Workspace super-admin (isAdmin=true) and can grant any GCP IAM role \u2014\
    \ including roles/owner and roles/resourcemanager.organizationAdmin \u2014 to any principal in the\
    \ linked GCP organization by accessing the Cloud Console or Resource Manager API. This is equivalent\
    \ to resourcemanager.organizations.setIamPolicy and constitutes full organization control."