本節列出 device 物件支援的屬性。如果系統找不到與要求中 ID 相關聯的裝置，下列所有屬性都會評估為錯誤。
屬性
encryption_status
類型
enum
說明
說明裝置的加密狀態。
列舉值：
enumDeviceEncryptionStatus{// The encryption status of the device is not specified or not known.ENCRYPTION_UNSPECIFIED==0;// The device does not support encryption.ENCRYPTION_UNSUPPORTED==1;// The device supports encryption, but is currently unencrypted.UNENCRYPTED==2;// The device is encrypted.ENCRYPTED==3;}
enumOsType{// The operating system of the device is not specified or not known.OS_UNSPECIFIED==0;// A desktop Mac operating system.DESKTOP_MAC==1;// A desktop Windows operating system.DESKTOP_WINDOWS==2;// A desktop Linux operating system.DESKTOP_LINUX==3;// An Android operating system.ANDROID==4;// An iOS operating system.IOS==5;// A desktop ChromeOS operating system.DESKTOP_CHROME_OS==6;}
此外，供應商可能會提供自己的鍵和值，並使用 data 屬性參照這些鍵和值。data 屬性的可用鍵會因供應商而異。比較政策運算式中的鍵值時，請務必保持一致。舉例來說，如果您預期鍵值為字串或布林值，請確保在政策運算式中，將鍵值與字串或布林值進行比較。請注意，如果值是整數，您應在政策運算式中與雙精度數字比較。
如要參照裝置狀態，請使用 key-acme 格式，其中 acme 是機構的客戶 ID。你可以從 GET https://www.googleapis.com/admin/directory/v1/customers/my_customer網址取得客戶 ID。回應中的 ID 欄位包含以字母 C 開頭的客戶 ID。請使用字母 C 後方的字串 (不含字母 C) 做為客戶 ID。
列舉值：
// Health score of the device as provided by the vendor (possibly third party).enumDeviceHealthScore{// The health score for the device is not specified or unknown.DEVICE_HEALTH_SCORE_UNSPECIFIED=0;// The health of the device is very poor.VERY_POOR=1;// The health of the device is poor.POOR=2;// The health of the device is ok.NEUTRAL=3;// The health of the device is good.GOOD=4;// The health of the device is very good.VERY_GOOD=5;}
// Checks if the enterprise certificate associated with the origin matches the device.device.certificates.exists(cert,cert.is_valid && cert.cert_fingerprint==origin.clientCertFingerprint())
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis document outlines four primary objects—\u003ccode\u003eorigin\u003c/code\u003e, \u003ccode\u003erequest.auth\u003c/code\u003e, \u003ccode\u003elevels\u003c/code\u003e, and \u003ccode\u003edevice\u003c/code\u003e—used to construct Common Expression Language (CEL) expressions for Access Context Manager, each containing specific attributes to evaluate access levels.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eorigin\u003c/code\u003e object offers attributes like \u003ccode\u003eip\u003c/code\u003e and \u003ccode\u003eregion_code\u003c/code\u003e to define the request's source, allowing checks like whether a user is within a specific IP range or region, and supports the use of \u003ccode\u003einIpRange\u003c/code\u003e to compare ip addresses.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erequest.auth\u003c/code\u003e object verifies user authentication, identifying the user's ID (\u003ccode\u003eprincipal\u003c/code\u003e) and the method used for authentication, such as password, push notification, or security key, via \u003ccode\u003eclaims.crd_str\u003c/code\u003e attributes.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edevice\u003c/code\u003e object provides detailed information about the requesting device, including its encryption status, admin approval, ownership, OS type, and device-specific attributes for third-party vendor data, and the use of security protocols.\u003c/p\u003e\n"],["\u003cp\u003eThe document also includes function and macro details for defining CEL expressions, such as \u003ccode\u003einIpRange\u003c/code\u003e, \u003ccode\u003edevice.versionAtLeast\u003c/code\u003e, \u003ccode\u003ecertificateBindingState\u003c/code\u003e, \u003ccode\u003ehas\u003c/code\u003e, and \u003ccode\u003ee.all\u003c/code\u003e , \u003ccode\u003ee.exists\u003c/code\u003e and \u003ccode\u003ee.exists_one\u003c/code\u003e for constructing complex access control rules.\u003c/p\u003e\n"]]],[],null,["# Custom access level specification\n\nThis page details the objects and attributes that are used to the build the\n[Common Expression Language](https://opensource.google.com/projects/cel) (CEL)\nexpressions for custom access levels. Examples are included.\n\nTo learn more about CEL, see the\n[CEL language definition](https://github.com/google/cel-spec/blob/master/doc/langdef.md).\n| **Note:** For [CEL macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros), custom access levels only support [those documented on this page](#macros).\n\nObjects\n-------\n\nAccess Context Manager provides four objects that contain access level attributes.\n\n### `origin` attributes\n\nThis section lists the attributes supported by the `origin` object.\n\n### `request.auth` attributes\n\nThis section lists the attributes supported by the `request.auth` object.\n\nFor more information about credential strength policy, see [Configuring a credential strength policy](https://cloud.google.com/access-context-manager/docs/create-credential-strength-policy).\n\n### `levels` attribute\n\nThis section lists the attributes supported by the `levels` object.\n\n### `device` attribute\n\nThis section lists the attributes supported by the `device` object. If no device\nassociated to the identifiers in the request is found, all of the following\nattributes will evaluate to an error.\n\nFunctions\n---------\n\nAccess Context Manager provides the following functions for use in the CEL\nexpressions for custom access levels.\n\nMacros for CEL expressions\n--------------------------\n\nYou can use the following macros in the CEL expressions for custom access levels:\n\nExample CEL expressions\n-----------------------\n\nThis section includes examples of CEL expressions used to create custom access\nlevels.\n\n### Example 1\n\n```protobuf\ndevice.encryption_status == DeviceEncryptionStatus.ENCRYPTED && (origin.region_code in [\"US\"] || device.is_admin_approved_device)\n```\n\nThis example represents an access level that requires the following conditions\nbe met in order to allow a request:\n\n- The device that the request originated from is encrypted.\n\n- One or more of the following is true:\n\n - The request originated in the United States.\n\n - The device that the request originated from is approved by the\n domain administrator.\n\n### Example 2\n\n```protobuf\n(device.os_type == OsType.DESKTOP_WINDOWS && device.is_corp_owned_device) || (device.os_type == OsType.DESKTOP_MAC && device.is_admin_approved_device && device.versionAtLeast(\"10.11.0\"))\n```\n\nThis example represents an access level that requires the following conditions\nbe met in order to allow a request:\n\n- One of the following is true:\n\n - The device that the request originated from uses a desktop Windows\n operating system and is owned by your organization.\n\n - The device that the request originated from uses a desktop Mac\n operating system, is approved by the domain administrator, and is\n using at least MacOS 10.11.\n\n### Example 3\n\n```protobuf\n(certificateBindingState(origin, device) == CertificateBindingState.CERT_MATCHES_EXISTING_DEVICE)\n```\n\nThis example represents an access level that requires the following condition\nbe met in order to allow a request:\n\n- The `certificateBindingState` extension function determines that the certificate presented at request time matches one of the device certificates that was registered when the device was enrolled in [endpoint verification](https://support.google.com/a/answer/9007320)."]]
