gcp-orgpolicy-modify-any-guardrail

orgpolicy.policy.set over ANY enforced OrganizationPolicy that blocks a modeled edge = guardrail-removal capability over it.

derived gcp emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?orgpolicy`
permissions	`orgpolicy.policy.set`
conditions	`guardrail_enforced` `iam_permission`
state logic	ACTIVE when orgpolicy.policy.set is unconditionally effective at the scope AND the constraint is enforced AND >=1 edge is BLOCKED by it; CONDITIONAL/ BLOCKED per the set permission's own gates. The per-edge BLOCKED->ACTIVE upgrade is guardrail-removal-upgrades-blocked's job, keyed on blocked_by.

source type

Identity

target type

*

source

?principal

target

?orgpolicy

permissions

orgpolicy.policy.set

conditions

guardrail_enforced iam_permission

state logic

ACTIVE when orgpolicy.policy.set is unconditionally effective at the scope AND the constraint is enforced AND >=1 edge is BLOCKED by it; CONDITIONAL/ BLOCKED per the set permission's own gates. The per-edge BLOCKED->ACTIVE upgrade is guardrail-removal-upgrades-blocked's job, keyed on blocked_by.

Narrative

{principal.name} can set the org policy at {scope.name} (orgpolicy.policy.set) over the enforced guardrail {orgpolicy.name} and lift the blocks it imposes on {gated_edges}.

Raw rule rules/derived/gcp/orgpolicy.yaml

id: gcp-orgpolicy-modify-any-guardrail
emits: CanModifyPolicy
description: orgpolicy.policy.set over ANY enforced OrganizationPolicy that blocks a modeled edge = guardrail-removal
  capability over it.
match:
- - principal: null
  - CanModifyPolicy
  - orgpolicy: null
where:
- node_type(?orgpolicy) == OrganizationPolicy
- ?principal has EFFECTIVE orgpolicy.policy.set at ?orgpolicy's scope
- ?orgpolicy is ENFORCED (spec, not dryRun-only) at/inherited-to ?scope
- there EXISTS >=1 edge e with state_of(e)==BLOCKED and blocked_by(e)==?orgpolicy
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?orgpolicy
  permissions:
  - orgpolicy.policy.set
  gates:
  - <the set of BLOCKED edges whose blocked_by == ?orgpolicy>
  conditions:
  - guardrail_enforced
  - iam_permission
  state_logic: ACTIVE when orgpolicy.policy.set is unconditionally effective at the scope AND the constraint
    is enforced AND >=1 edge is BLOCKED by it; CONDITIONAL/ BLOCKED per the set permission's own gates.
    The per-edge BLOCKED->ACTIVE upgrade is guardrail-removal-upgrades-blocked's job, keyed on blocked_by.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanModifyPolicy ?orgpolicy
  - blocked_by(e)==?orgpolicy for >=1 e
  - guardrail-removal-upgrades-blocked (hierarchy-chains.yaml)
  false_positive_note: "Guardrail against over-claiming: emit ONLY when the org policy actually suppresses\
    \ at least one modeled edge (blocked_by == this node). A constraint that blocks nothing in the graph\
    \ (e.g. requireShieldedVm \u2014 pure hardening with no discrete edge in our vocab) yields NO edge\
    \ here. Dedupe against the constraint-specific rules above on (CanModifyPolicy, principal, orgpolicy);\
    \ this rule only adds coverage for constraints not individually enumerated."
  narrative: '{principal.name} can set the org policy at {scope.name} (orgpolicy.policy.set) over the
    enforced guardrail {orgpolicy.name} and lift the blocks it imposes on {gated_edges}.'