rage.fail

gcp-run-invoke

derived gcp emits CanInvoke

match (effective permission)

{ "action": "run.routes.invoke", "resource_type": "google.cloud.run.Service" }

emit

source type	`Identity`
source	`<principal>`
target	`<Cloud Run service in scope>`
permissions	`run.routes.invoke`

Narrative

{principal.name} can invoke Cloud Run service {resource.name} (run.routes.invoke).

Raw rule rules/derived/gcp/cloudrun.yaml

id: gcp-run-invoke
emits: CanInvoke
match_effective_permission:
  action: run.routes.invoke
  resource_type: google.cloud.run.Service
emit:
  source_type: Identity
  source: <principal>
  target: <Cloud Run service in scope>
  permissions:
  - run.routes.invoke
  note: Invoke alone is not execution-as; it completes an escalation only when the image was swapped (gcp-run-update-code)
    or via runWithOverrides.
  target_class_note: A Cloud Run service maps to ContainerService, which is not in schema CanInvoke.target
    [ServerlessFunction, API, APIGateway, Workflow]. Request-driven Cloud Run services are legitimately
    invokable, so ContainerService is treated as an invokable-target equivalent here; reflect by adding
    ContainerService to CanInvoke.target in schema/edges.yaml.
  narrative: '{principal.name} can invoke Cloud Run service {resource.name} (run.routes.invoke).'