Policy API concepts

This documentation describes Cloud Identity Policy API concepts and strategies.

Reduction

To list and get policies, see Setting up the Policy API and Listing and getting policies .

Terminology

• Setting value: setting values provided in the policy

• Reduced Setting value: final setting values applied to a target, such as a user, an organization unit, or a group

• Reduction: the process of reducing setting values on policies to a single setting value for a target, such as a user, an organization unit, or a group

• Reducer: the type of rules that determine how setting values on policies are simplified down to a single setting for a user

• Admin policies: policies created by administrators in the Admin console

• System policies: policies provided by Google Workspace

Reduction Process

To reduce a given setting for a given user:

1. Filter out all policies that don't apply to the user.

   1. Filter out policies that don't contain the setting.

   2. Filter out policies that apply to the OU that the target user isn't in.

   3. Filter out policies that apply to the Group that the target user isn't in.

   4. Filter out policies that apply to the License that the target user doesn't have. To learn more information about licenses, see Licenses section.

2. Apply the Reducer of the given Setting

   • Max: For each field on the reduced setting, the Max reducer chooses the value from the policy with the greatest sortOrder .

   • Merge: For each field on the reduced setting, the Merge reducer chooses the value from the policy with the greatest sortOrder that has a value for that field. If the field is an array, the Merge reducer instead concatenates the values from all the policies.

   • MaxMap: The MaxMap reducer is used for settings where the array entries have a field that functions as a primary key. The MaxMap reducer doesn't concatenate the array entries with the same primary key. Instead, it updates the entry using the Max reducer on the other fields in the array entries that share the same primary key.

   • MergeMap: The MergeMap reducer is used for settings where the array entries have a field that functions as a primary key. The MergeMap reducer doesn't concatenate the array entries with the same primary key. Instead, it updates the entry using the Merge reducer on the other fields in the array entries that share the same primary key.

   • List: These settings are not reduced to a single setting. Instead, the entire sequence of settings is preserved and applied as a list.

Reducers for settings

Licenses

Policies apply to users based on users' Workspace licenses. The license condition is provided in PolicyQuery .

For a full list of all Workspace Product and SKU IDs see Google Product and SKU IDs .

The following examples demonstrate how policies can be applied to certain groups of users based on those users' licenses.

Example 1: Normal clause only

entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010020027'])

The policy applies to a user if they have a license for at least one of the SKUs in the list.

Example 2: Normal clause and inverted clause

entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010020027']) && !entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010060005'])

The policy applies to a user if they have a license for at least one of the SKUs in the first clause. However, if a user has a license for any of the SKUs in the second clause, the policy does not apply to that user at all.

Example 3: Inverted clause only

!entity.licenses.exists(license, license in ['/product/Google-Apps/sku/1010060005'])

The policy applies to a user if they don't have a license for any SKUs in the list.

Default Field Values

When a field is not present on the Reduced Setting, its default value is as follows:

System Groups

Google system groups that are not surfaced in the Directory API that can be linked from system policies.