Google Cloud API 请求可能涉及对多个资源执行的操作。组织限制标头服务会检查请求中的所有资源是否都在已获授权的组织列表中。如果任何资源不在已获授权的组织列表中，则请求会被拒绝。
允许保险柜用户下载
Google 保险柜是适用于 Google Workspace 的信息治理和电子取证工具。保险柜管理员可以访问存储在 Google 拥有的 Cloud Storage 存储分区中的 Google Workspace 用户数据。
默认情况下，“组织限制”功能会限制保险柜管理员从 Google 拥有的 Cloud Storage 存储分区下载导出的 Google Workspace 用户数据。如需允许来自保险柜管理员的请求，请确保将用于存储保险柜数据的组织 ID organizations/433637338589 添加到组织权限限制标头中。
我们建议仅在保险柜管理员发出的请求的标头中添加存储保险柜数据的组织的此 ID。
启用对 Google 自有资源的访问权限
为了让开发者能够使用 Google Cloud BigQuery 或 Compute Engine 等服务 Google Cloud ，我们提供了 Google 拥有的公共资源。例如，Compute Engine 提供公共操作系统映像，可帮助开发者快速开始构建自己的映像，或利用其中一个映像来托管其工作负载。其他 Google Cloud 服务采用类似的公共资源模式。这些公共资源托管在 Google 拥有的 Google Cloud 组织中。
为确保您组织的用户在您强制执行组织限制后仍能访问这些公共资源，请将以下 Google 自有组织 ID 添加到“组织限制”标题中的已获授权组织列表中： Google Cloud Google Cloud
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Additional considerations\n\nThis page lists additional considerations you must be aware of when using organization restrictions.\n\n### Multi-resource access\n\nGoogle Cloud API requests might involve operations on multiple resources. Organization restrictions\nheader service checks whether all resources that are part of the request\nare in the list of authorized organizations. If any resource is not part of the list of authorized\norganizations, the request is denied.\n\n### Allow download for Vault users\n\n[Google Vault](https://support.google.com/vault/answer/2462365) is an information governance\nand eDiscovery tool for Google Workspace. Vault administrators access Google Workspace user data stored\nin Google-owned Cloud Storage buckets.\n\nBy default, the organization restrictions feature restricts Vault administrators from downloading\nan exported Google Workspace user data from a Google-owned Cloud Storage bucket.\nTo allow requests that originate from the Vault administrators, ensure that organization ID\n`organizations/433637338589`, which stores Vault data, is added to the organization restrictions header.\n\nWe recommend to add this ID of the organization, which stores Vault data, only in headers\nfor requests from Vault administrators.\n\n### Enable access to Google-owned resources\n\nTo enable developers to use Google Cloud services, such as BigQuery\nor Compute Engine, Google Cloud provides Google-owned public resources. For example,\nCompute Engine provides [public OS images](/compute/docs/images#os-compute-support)\nthat help developers quickly get started with building their own or leveraging one\nof these images to host their workloads. Other Google Cloud services employ similar\npublic resource patterns. These public resources are hosted in a Google-owned Google Cloud organization.\n\nTo ensure that users of your Google Cloud organization continue to have access\nto these public resources after you enforce organization restrictions, add the\nfollowing Google-owned Google Cloud organization ID to the list of authorized organizations\nin the organization restrictions header: \n\n organizations/433637338589\n\nWhat's next\n-----------\n\n- Learn about [using organization restrictions](/resource-manager/docs/organization-restrictions/examples-org-restrictions).\n- Learn about the [services supported by organization restrictions](/resource-manager/docs/organization-restrictions/supported-services)."]]
