借助组织权限限制功能，您可以防止因钓鱼式攻击或内部攻击而导致的数据渗漏。对于组织中的受管设备，组织权限限制功能仅允许访问已获授权的 Google Cloud 组织中的资源。
组织权限限制运作方式
在 Google Cloud中，Identity and Access Management (IAM) 用于管理对资源的访问权限。管理员使用允许和拒绝政策来控制哪些人可以访问其组织中的资源。组织需要限制其员工只能访问已获授权的 Google Cloud组织中的资源。 Google Cloud 管理员（负责管理 Google Cloud）和出站流量代理管理员（负责配置出站流量代理）共同设置组织权限限制。
下图展示了不同组件如何协同工作来强制执行组织权限限制：
架构图显示了以下组件：
受管设备：受公司组织政策约束的设备。组织的员工使用受管设备访问组织资源。
出站流量代理：出站流量代理管理员将代理配置为向源自受管设备的所有请求添加组织权限限制标头。此代理配置可防止用户访问未经授权的 Google Cloud 组织中的任何资源。 Google Cloud
Google Cloud： Google Cloud 中的组织权限限制功能会检查所有请求的组织权限限制标头，并根据要访问的组织允许或拒绝请求。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Introduction to organization restrictions\n\nThis page provides an overview of organization restrictions and how it works.\n\nThe organization restrictions feature lets you prevent data exfiltration\nthrough phishing or insider attacks. For managed devices in an organization, the organization restrictions\nfeature restricts access only to resources in authorized Google Cloud organizations.\n\nHow organization restrictions works\n-----------------------------------\n\nIn Google Cloud, Identity and Access Management (IAM) governs access to resources.\nAdministrators use allow and deny policies to control who can access the\nresources within their organization. There is a need in organizations to\nrestrict access of their employees only to resources in authorized Google Cloud\norganizations. Google Cloud administrators who administer Google Cloud, and\negress proxy administrators, who configure the egress proxy, engage together to\nset up organization restrictions.\n\nThe following diagram illustrates how the different components work to enforce organization restrictions:\n\nThe architecture diagram shows the following components:\n\n- **Managed device**: A device that is governed by the organization policies of\n a company. Employees of an organization use a managed device to access the organization\n resources.\n\n- **Egress proxy**: An egress proxy administrator configures\n the proxy to add organization restrictions headers to any requests originating\n from a managed device. This proxy configuration prevents\n users from accessing any Google Cloud resources in non-authorized Google Cloud organizations.\n\n- **Google Cloud**: The organization restrictions feature in Google Cloud inspects all requests\n for organization restrictions header, and allows or denies the requests based on\n the organization being accessed.\n\nCommon use cases\n----------------\n\nHere are some common organization restrictions use cases:\n\n- Restrict access to employees in your organization so that employees can\n [access resources only in your Google Cloud organization](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-your-org)\n and not other organizations.\n\n- [Allow your employees to read from Cloud Storage resources](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-read-org)\n but restrict employee access only to resources in your Google Cloud organization.\n\n- [Allow your employees to access a vendor Google Cloud organization](/resource-manager/docs/organization-restrictions/examples-org-restrictions#access-vendor-org) in addition\n to your Google Cloud organization.\n\nImplementing these use cases require engagement between Google Cloud administrators,\nwho administer Google Cloud, and egress proxy administrators who configure the egress proxy.\n\nWhat's next\n-----------\n\n- Learn about [organization restrictions configuration](/resource-manager/docs/organization-restrictions/configure-organization-restrictions).\n- Learn about the [services supported by organization restrictions](/resource-manager/docs/organization-restrictions/supported-services)."]]
