enumDeviceEncryptionStatus{// The encryption status of the device is not specified or not known.ENCRYPTION_UNSPECIFIED==0;// The device does not support encryption.ENCRYPTION_UNSUPPORTED==1;// The device supports encryption, but is currently unencrypted.UNENCRYPTED==2;// The device is encrypted.ENCRYPTED==3;}
enumOsType{// The operating system of the device is not specified or not known.OS_UNSPECIFIED==0;// A desktop Mac operating system.DESKTOP_MAC==1;// A desktop Windows operating system.DESKTOP_WINDOWS==2;// A desktop Linux operating system.DESKTOP_LINUX==3;// An Android operating system.ANDROID==4;// An iOS operating system.IOS==5;// A desktop ChromeOS operating system.DESKTOP_CHROME_OS==6;}
// Health score of the device as provided by the vendor (possibly third party).enumDeviceHealthScore{// The health score for the device is not specified or unknown.DEVICE_HEALTH_SCORE_UNSPECIFIED=0;// The health of the device is very poor.VERY_POOR=1;// The health of the device is poor.POOR=2;// The health of the device is ok.NEUTRAL=3;// The health of the device is good.GOOD=4;// The health of the device is very good.VERY_GOOD=5;}
// Checks if the enterprise certificate associated with the origin matches the device.device.certificates.exists(cert,cert.is_valid && cert.cert_fingerprint==origin.clientCertFingerprint())
述語が、リスト e のすべての要素を保持しているか、マップ e のキーを保持しているかをテストします。ここで、x は、要素またはキーにバインドする p で使用する識別子です。all() マクロは、要素ごとの述語結果を and（&&）演算子で結合します。そのため、述語のいずれかが false と評価されると、このマクロは他の述語のエラーを無視して false と評価されます。例:
すべての要素が 1 より大きいとは限らないため、false を返します。 [1,2,3].all(x, x > 1)
e.exists(x, p)
all() マクロと似ていますが、述語結果を or（||）演算子で結合します。例:
リストに 1 を超える要素が少なくとも 1 つ存在するため、true が返されます。 [1,2,3].exists(x, x > 1)
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eThis document outlines four primary objects—\u003ccode\u003eorigin\u003c/code\u003e, \u003ccode\u003erequest.auth\u003c/code\u003e, \u003ccode\u003elevels\u003c/code\u003e, and \u003ccode\u003edevice\u003c/code\u003e—used to construct Common Expression Language (CEL) expressions for Access Context Manager, each containing specific attributes to evaluate access levels.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eorigin\u003c/code\u003e object offers attributes like \u003ccode\u003eip\u003c/code\u003e and \u003ccode\u003eregion_code\u003c/code\u003e to define the request's source, allowing checks like whether a user is within a specific IP range or region, and supports the use of \u003ccode\u003einIpRange\u003c/code\u003e to compare ip addresses.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erequest.auth\u003c/code\u003e object verifies user authentication, identifying the user's ID (\u003ccode\u003eprincipal\u003c/code\u003e) and the method used for authentication, such as password, push notification, or security key, via \u003ccode\u003eclaims.crd_str\u003c/code\u003e attributes.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edevice\u003c/code\u003e object provides detailed information about the requesting device, including its encryption status, admin approval, ownership, OS type, and device-specific attributes for third-party vendor data, and the use of security protocols.\u003c/p\u003e\n"],["\u003cp\u003eThe document also includes function and macro details for defining CEL expressions, such as \u003ccode\u003einIpRange\u003c/code\u003e, \u003ccode\u003edevice.versionAtLeast\u003c/code\u003e, \u003ccode\u003ecertificateBindingState\u003c/code\u003e, \u003ccode\u003ehas\u003c/code\u003e, and \u003ccode\u003ee.all\u003c/code\u003e , \u003ccode\u003ee.exists\u003c/code\u003e and \u003ccode\u003ee.exists_one\u003c/code\u003e for constructing complex access control rules.\u003c/p\u003e\n"]]],[],null,["# Custom access level specification\n\nThis page details the objects and attributes that are used to the build the\n[Common Expression Language](https://opensource.google.com/projects/cel) (CEL)\nexpressions for custom access levels. Examples are included.\n\nTo learn more about CEL, see the\n[CEL language definition](https://github.com/google/cel-spec/blob/master/doc/langdef.md).\n| **Note:** For [CEL macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros), custom access levels only support [those documented on this page](#macros).\n\nObjects\n-------\n\nAccess Context Manager provides four objects that contain access level attributes.\n\n### `origin` attributes\n\nThis section lists the attributes supported by the `origin` object.\n\n### `request.auth` attributes\n\nThis section lists the attributes supported by the `request.auth` object.\n\nFor more information about credential strength policy, see [Configuring a credential strength policy](https://cloud.google.com/access-context-manager/docs/create-credential-strength-policy).\n\n### `levels` attribute\n\nThis section lists the attributes supported by the `levels` object.\n\n### `device` attribute\n\nThis section lists the attributes supported by the `device` object. If no device\nassociated to the identifiers in the request is found, all of the following\nattributes will evaluate to an error.\n\nFunctions\n---------\n\nAccess Context Manager provides the following functions for use in the CEL\nexpressions for custom access levels.\n\nMacros for CEL expressions\n--------------------------\n\nYou can use the following macros in the CEL expressions for custom access levels:\n\nExample CEL expressions\n-----------------------\n\nThis section includes examples of CEL expressions used to create custom access\nlevels.\n\n### Example 1\n\n```protobuf\ndevice.encryption_status == DeviceEncryptionStatus.ENCRYPTED && (origin.region_code in [\"US\"] || device.is_admin_approved_device)\n```\n\nThis example represents an access level that requires the following conditions\nbe met in order to allow a request:\n\n- The device that the request originated from is encrypted.\n\n- One or more of the following is true:\n\n - The request originated in the United States.\n\n - The device that the request originated from is approved by the\n domain administrator.\n\n### Example 2\n\n```protobuf\n(device.os_type == OsType.DESKTOP_WINDOWS && device.is_corp_owned_device) || (device.os_type == OsType.DESKTOP_MAC && device.is_admin_approved_device && device.versionAtLeast(\"10.11.0\"))\n```\n\nThis example represents an access level that requires the following conditions\nbe met in order to allow a request:\n\n- One of the following is true:\n\n - The device that the request originated from uses a desktop Windows\n operating system and is owned by your organization.\n\n - The device that the request originated from uses a desktop Mac\n operating system, is approved by the domain administrator, and is\n using at least MacOS 10.11.\n\n### Example 3\n\n```protobuf\n(certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE)\n```\n\nThis example represents an access level that requires the following condition\nbe met in order to allow a request:\n\n- The `certificateBindingState` extension function determines that the certificate presented at request time matches one of the device certificates that was registered when the device was enrolled in [endpoint verification](https://support.google.com/a/answer/9007320)."]]
