gcp-orgpolicy-modify-custom-constraint

Delete/alter a custom org-policy constraint that enforces a security invariant, unblocking what it suppressed.

derived gcp emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?orgpolicy`
permissions	`orgpolicy.customConstraints.delete` `orgpolicy.customConstraints.update` `orgpolicy.policy.set`
conditions	`guardrail_enforced` `iam_permission`
state logic	ACTIVE when the principal effectively holds orgpolicy.customConstraints.delete/.update (custom constraints are defined at the organization) AND the custom constraint is enforced AND blocks >=1 edge; CONDITIONAL/BLOCKED per the permission's gates. Downstream upgrade deferred to hierarchy-chains.

source type

Identity

target type

*

source

?principal

target

?orgpolicy

permissions

orgpolicy.customConstraints.delete orgpolicy.customConstraints.update orgpolicy.policy.set

conditions

guardrail_enforced iam_permission

state logic

ACTIVE when the principal effectively holds orgpolicy.customConstraints.delete/.update (custom constraints are defined at the organization) AND the custom constraint is enforced AND blocks >=1 edge; CONDITIONAL/BLOCKED per the permission's gates. Downstream upgrade deferred to hierarchy-chains.

Narrative

{principal.name} can delete/alter the custom org-policy constraint {orgpolicy.name} (orgpolicy.customConstraints.delete/update), lifting the blocks it imposes across the organization.

Raw rule rules/derived/gcp/orgpolicy.yaml

id: gcp-orgpolicy-modify-custom-constraint
emits: CanModifyPolicy
description: Delete/alter a custom org-policy constraint that enforces a security invariant, unblocking
  what it suppressed.
match:
- - principal: null
  - CanModifyPolicy
  - orgpolicy: null
where:
- node_type(?orgpolicy) == OrganizationPolicy
- ?orgpolicy.constraint starts with 'constraints/custom.'
- ?principal has EFFECTIVE orgpolicy.customConstraints.delete or .update at the organization (custom constraints
  are org-defined)
- ?orgpolicy is ENFORCED and blocks >=1 modeled edge (blocked_by == ?orgpolicy)
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?orgpolicy
  permissions:
  - orgpolicy.customConstraints.delete
  - orgpolicy.customConstraints.update
  - orgpolicy.policy.set
  gates:
  - <the BLOCKED edges whose blocked_by == this custom constraint>
  conditions:
  - guardrail_enforced
  - iam_permission
  state_logic: ACTIVE when the principal effectively holds orgpolicy.customConstraints.delete/.update
    (custom constraints are defined at the organization) AND the custom constraint is enforced AND blocks
    >=1 edge; CONDITIONAL/BLOCKED per the permission's gates. Downstream upgrade deferred to hierarchy-chains.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanModifyPolicy ?orgpolicy (custom constraint)
  - guardrail-removal-upgrades-blocked (hierarchy-chains.yaml)
  false_positive_note: "Custom constraints are DEFINED at the organization (orgpolicy.customConstraints.*)\
    \ but ENFORCED via a policy binding (orgpolicy.policy.set) at any scope. Deleting the definition removes\
    \ it everywhere; disabling the binding removes it at that scope \u2014 either lifts the block. Fire\
    \ only when the custom constraint actually suppresses a modeled edge; a custom constraint governing\
    \ a resource type we do not model yields no edge."
  narrative: '{principal.name} can delete/alter the custom org-policy constraint {orgpolicy.name} (orgpolicy.customConstraints.delete/update),
    lifting the blocks it imposes across the organization.'