var (
	PolicyBinding_PolicyKind_name = map[int32]string{
		0: "POLICY_KIND_UNSPECIFIED",
		1: "PRINCIPAL_ACCESS_BOUNDARY",
	}
	PolicyBinding_PolicyKind_value = map[string]int32{
		"POLICY_KIND_UNSPECIFIED":   0,
		"PRINCIPAL_ACCESS_BOUNDARY": 1,
	}
)

var (
	PrincipalAccessBoundaryPolicyRule_Effect_name = map[int32]string{
		0: "EFFECT_UNSPECIFIED",
		1: "ALLOW",
	}
	PrincipalAccessBoundaryPolicyRule_Effect_value = map[string]int32{
		"EFFECT_UNSPECIFIED": 0,
		"ALLOW":              1,
	}
)

var File_google_iam_v3_operation_metadata_proto protoreflect.FileDescriptor

var File_google_iam_v3_policy_binding_resources_proto protoreflect.FileDescriptor

var File_google_iam_v3_policy_bindings_service_proto protoreflect.FileDescriptor

var File_google_iam_v3_principal_access_boundary_policies_service_proto protoreflect.FileDescriptor

var File_google_iam_v3_principal_access_boundary_policy_resources_proto protoreflect.FileDescriptor

type CreatePolicyBindingRequest struct {

	// Required. The parent resource where this policy binding will be created.
	// The binding parent is the closest Resource Manager resource (project,
	// folder or organization) to the binding target.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}`
	// * `projects/{project_number}/locations/{location}`
	// * `folders/{folder_id}/locations/{location}`
	// * `organizations/{organization_id}/locations/{location}`
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The ID to use for the policy binding, which will become the final
	// component of the policy binding's resource name.
	//
	// This value must start with a lowercase letter followed by up to 62
	// lowercase letters, numbers, hyphens, or dots. Pattern,
	// /[a-z][a-z0-9-\.]{2,62}/.
	PolicyBindingId string `protobuf:"bytes,2,opt,name=policy_binding_id,json=policyBindingId,proto3" json:"policy_binding_id,omitempty"`
	// Required. The policy binding to create.
	PolicyBinding *PolicyBinding `protobuf:"bytes,3,opt,name=policy_binding,json=policyBinding,proto3" json:"policy_binding,omitempty"`
	// Optional. If set, validate the request and preview the creation, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,4,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// contains filtered or unexported fields
}

type CreatePrincipalAccessBoundaryPolicyRequest struct {

	// Required. The parent resource where this principal access boundary policy
	// will be created. Only organizations are supported.
	//
	// Format:
	//
	//	`organizations/{organization_id}/locations/{location}`
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The ID to use for the principal access boundary policy, which
	// will become the final component of the principal access boundary policy's
	// resource name.
	//
	// This value must start with a lowercase letter followed by up to 62
	// lowercase letters, numbers, hyphens, or dots. Pattern,
	// /[a-z][a-z0-9-\.]{2,62}/.
	PrincipalAccessBoundaryPolicyId string `protobuf:"bytes,2,opt,name=principal_access_boundary_policy_id,json=principalAccessBoundaryPolicyId,proto3" json:"principal_access_boundary_policy_id,omitempty"`
	// Required. The principal access boundary policy to create.
	PrincipalAccessBoundaryPolicy *PrincipalAccessBoundaryPolicy `protobuf:"bytes,3,opt,name=principal_access_boundary_policy,json=principalAccessBoundaryPolicy,proto3" json:"principal_access_boundary_policy,omitempty"`
	// Optional. If set, validate the request and preview the creation, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,4,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// contains filtered or unexported fields
}

type DeletePolicyBindingRequest struct {

	// Required. The name of the policy binding to delete.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. The etag of the policy binding.
	// If this is provided, it must match the server's etag.
	Etag string `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
	// Optional. If set, validate the request and preview the deletion, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,3,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// contains filtered or unexported fields
}

type DeletePrincipalAccessBoundaryPolicyRequest struct {

	// Required. The name of the principal access boundary policy to delete.
	//
	// Format:
	//
	//	`organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. The etag of the principal access boundary policy.
	// If this is provided, it must match the server's etag.
	Etag string `protobuf:"bytes,2,opt,name=etag,proto3" json:"etag,omitempty"`
	// Optional. If set, validate the request and preview the deletion, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,3,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// Optional. If set to true, the request will force the deletion of the policy
	// even if the policy is referenced in policy bindings.
	Force bool `protobuf:"varint,4,opt,name=force,proto3" json:"force,omitempty"`
	// contains filtered or unexported fields
}

type GetPolicyBindingRequest struct {

	// Required. The name of the policy binding to retrieve.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetPrincipalAccessBoundaryPolicyRequest struct {

	// Required. The name of the principal access boundary policy to retrieve.
	//
	// Format:
	//
	//	`organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ListPolicyBindingsRequest struct {

	// Required. The parent resource, which owns the collection of policy
	// bindings.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}`
	// * `projects/{project_number}/locations/{location}`
	// * `folders/{folder_id}/locations/{location}`
	// * `organizations/{organization_id}/locations/{location}`
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Optional. The maximum number of policy bindings to return. The service may
	// return fewer than this value.
	//
	// If unspecified, at most 50 policy bindings will be returned.
	// The maximum value is 1000; values above 1000 will be coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Optional. A page token, received from a previous `ListPolicyBindings` call.
	// Provide this to retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to `ListPolicyBindings` must
	// match the call that provided the page token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Optional. An expression for filtering the results of the request. Filter
	// rules are case insensitive. Some eligible fields for filtering are:
	//
	// + `target`
	// + `policy`
	//
	// Some examples of filter queries:
	//
	// * `target:ex*`: The binding target's name starts with "ex".
	// * `target:example`: The binding target's name is `example`.
	// * `policy:example`: The binding policy's name is `example`.
	Filter string `protobuf:"bytes,4,opt,name=filter,proto3" json:"filter,omitempty"`
	// contains filtered or unexported fields
}

type ListPolicyBindingsResponse struct {

	// The policy bindings from the specified parent.
	PolicyBindings []*PolicyBinding `protobuf:"bytes,1,rep,name=policy_bindings,json=policyBindings,proto3" json:"policy_bindings,omitempty"`
	// Optional. A token, which can be sent as `page_token` to retrieve the next
	// page. If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListPrincipalAccessBoundaryPoliciesRequest struct {

	// Required. The parent resource, which owns the collection of principal
	// access boundary policies.
	//
	// Format:
	//
	//	`organizations/{organization_id}/locations/{location}`
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Optional. The maximum number of principal access boundary policies to
	// return. The service may return fewer than this value.
	//
	// If unspecified, at most 50 principal access boundary policies will be
	// returned. The maximum value is 1000; values above 1000 will be coerced to
	// 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Optional. A page token, received from a previous
	// `ListPrincipalAccessBoundaryPolicies` call. Provide this to retrieve the
	// subsequent page.
	//
	// When paginating, all other parameters provided to
	// `ListPrincipalAccessBoundaryPolicies` must match the call that provided the
	// page token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListPrincipalAccessBoundaryPoliciesResponse struct {

	// The principal access boundary policies from the specified parent.
	PrincipalAccessBoundaryPolicies []*PrincipalAccessBoundaryPolicy `protobuf:"bytes,1,rep,name=principal_access_boundary_policies,json=principalAccessBoundaryPolicies,proto3" json:"principal_access_boundary_policies,omitempty"`
	// Optional. A token, which can be sent as `page_token` to retrieve the next
	// page. If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type OperationMetadata struct {

	// Output only. The time the operation was created.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. The time the operation finished running.
	EndTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
	// Output only. Server-defined resource path for the target of the
	Target string `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
	// Output only. Name of the verb executed by the operation.
	Verb string `protobuf:"bytes,4,opt,name=verb,proto3" json:"verb,omitempty"`
	// Output only. Human-readable status of the operation, if any.
	StatusMessage string `protobuf:"bytes,5,opt,name=status_message,json=statusMessage,proto3" json:"status_message,omitempty"`
	// Output only. Identifies whether the user has requested cancellation
	// of the operation. Operations that have successfully been cancelled
	// have [Operation.error][] value with a
	// [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
	// `Code.CANCELLED`.
	RequestedCancellation bool `protobuf:"varint,6,opt,name=requested_cancellation,json=requestedCancellation,proto3" json:"requested_cancellation,omitempty"`
	// Output only. API version used to start the operation.
	ApiVersion string `protobuf:"bytes,7,opt,name=api_version,json=apiVersion,proto3" json:"api_version,omitempty"`
	// contains filtered or unexported fields
}

type PolicyBinding struct {

	// Identifier. The name of the policy binding, in the format
	// `{binding_parent/locations/{location}/policyBindings/{policy_binding_id}`.
	// The binding parent is the closest Resource Manager resource (project,
	// folder, or organization) to the binding target.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `projects/{project_number}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `folders/{folder_id}/locations/{location}/policyBindings/{policy_binding_id}`
	// * `organizations/{organization_id}/locations/{location}/policyBindings/{policy_binding_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Output only. The globally unique ID of the policy binding. Assigned when
	// the policy binding is created.
	Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"`
	// Optional. The etag for the policy binding.
	// If this is provided on update, it must match the server's etag.
	Etag string `protobuf:"bytes,3,opt,name=etag,proto3" json:"etag,omitempty"`
	// Optional. The description of the policy binding. Must be less than or equal
	// to 63 characters.
	DisplayName string `protobuf:"bytes,4,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Optional. User-defined annotations. See
	// https://google.aip.dev/148#annotations for more details such as format and
	// size limitations
	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Required. Immutable. Target is the full resource name of the resource to
	// which the policy will be bound. Immutable once set.
	Target *PolicyBinding_Target `protobuf:"bytes,6,opt,name=target,proto3" json:"target,omitempty"`
	// Immutable. The kind of the policy to attach in this binding. This field
	// must be one of the following:
	//
	// - Left empty (will be automatically set to the policy kind)
	// - The input policy kind
	PolicyKind PolicyBinding_PolicyKind `protobuf:"varint,11,opt,name=policy_kind,json=policyKind,proto3,enum=google.iam.v3.PolicyBinding_PolicyKind" json:"policy_kind,omitempty"`
	// Required. Immutable. The resource name of the policy to be bound. The
	// binding parent and policy must belong to the same organization.
	Policy string `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"`
	// Output only. The globally unique ID of the policy to be bound.
	PolicyUid string `protobuf:"bytes,12,opt,name=policy_uid,json=policyUid,proto3" json:"policy_uid,omitempty"`
	// Optional. The condition to apply to the policy binding. When set, the
	// `expression` field in the `Expr` must include from 1 to 10 subexpressions,
	// joined by the
	// "||"(Logical OR), "&&"(Logical AND) or "!"(Logical NOT) operators and
	// cannot contain more than 250 characters.
	//
	// The condition is currently only supported when bound to policies of kind
	// principal access boundary.
	//
	// When the bound policy is a principal access boundary policy, the only
	// supported attributes in any subexpression are `principal.type` and
	// `principal.subject`. An example expression is: "principal.type ==
	// 'iam.googleapis.com/ServiceAccount'" or "principal.subject ==
	// 'bob@example.com'".
	//
	// Allowed operations for `principal.subject`:
	//
	// - `principal.subject == <principal subject string>`
	// - `principal.subject != <principal subject string>`
	// - `principal.subject in [<list of principal subjects>]`
	// - `principal.subject.startsWith(<string>)`
	// - `principal.subject.endsWith(<string>)`
	//
	// Allowed operations for `principal.type`:
	//
	// - `principal.type == <principal type string>`
	// - `principal.type != <principal type string>`
	// - `principal.type in [<list of principal types>]`
	//
	// Supported principal types are Workspace, Workforce Pool, Workload Pool and
	// Service Account. Allowed string must be one of:
	//
	// - iam.googleapis.com/WorkspaceIdentity
	// - iam.googleapis.com/WorkforcePoolIdentity
	// - iam.googleapis.com/WorkloadPoolIdentity
	// - iam.googleapis.com/ServiceAccount
	Condition *expr.Expr `protobuf:"bytes,8,opt,name=condition,proto3" json:"condition,omitempty"`
	// Output only. The time when the policy binding was created.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. The time when the policy binding was most recently updated.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// contains filtered or unexported fields
}

type PolicyBinding_PolicyKind int32

const (
	// Unspecified policy kind; Not a valid state
	PolicyBinding_POLICY_KIND_UNSPECIFIED PolicyBinding_PolicyKind = 0
	// Principal access boundary policy kind
	PolicyBinding_PRINCIPAL_ACCESS_BOUNDARY PolicyBinding_PolicyKind = 1
)

type PolicyBinding_Target struct {

	// The different types of targets that can be bound to a policy.
	//
	// Types that are assignable to Target:
	//
	//	*PolicyBinding_Target_PrincipalSet
	Target isPolicyBinding_Target_Target `protobuf_oneof:"target"`
	// contains filtered or unexported fields
}

type PolicyBinding_Target_PrincipalSet struct {
	// Immutable. Full Resource Name used for principal access boundary policy
	// bindings. The principal set must be directly parented by the policy
	// binding's parent or same as the parent if the target is a
	// project/folder/organization.
	//
	// Examples:
	// * For binding's parented by an organization:
	//   - Organization:
	//     `//cloudresourcemanager.googleapis.com/organizations/ORGANIZATION_ID`
	//   - Workforce Identity:
	//     `//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID`
	//   - Workspace Identity:
	//     `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID`
	//
	// * For binding's parented by a folder:
	//   - Folder:
	//     `//cloudresourcemanager.googleapis.com/folders/FOLDER_ID`
	//
	// * For binding's parented by a project:
	//   - Project:
	//   - `//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER`
	//   - `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`
	//   - Workload Identity Pool:
	//     `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/LOCATION/workloadIdentityPools/WORKLOAD_POOL_ID`
	PrincipalSet string `protobuf:"bytes,1,opt,name=principal_set,json=principalSet,proto3,oneof"`
}

type PolicyBindingsClient interface {
	// Creates a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on both the policy and target.
	// Once the binding is created, the policy is applied to the target.
	CreatePolicyBinding(ctx context.Context, in *CreatePolicyBindingRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Gets a policy binding.
	GetPolicyBinding(ctx context.Context, in *GetPolicyBindingRequest, opts ...grpc.CallOption) (*PolicyBinding, error)
	// Updates a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on the policy and target in the
	// binding to update, and the IAM permission to remove the existing policy
	// from the binding. Target is immutable and cannot be updated. Once the
	// binding is updated, the new policy is applied to the target.
	UpdatePolicyBinding(ctx context.Context, in *UpdatePolicyBindingRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Deletes a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on both the policy and target.
	// Once the binding is deleted, the policy no longer applies to the target.
	DeletePolicyBinding(ctx context.Context, in *DeletePolicyBindingRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Lists policy bindings.
	ListPolicyBindings(ctx context.Context, in *ListPolicyBindingsRequest, opts ...grpc.CallOption) (*ListPolicyBindingsResponse, error)
	// Search policy bindings by target. Returns all policy binding objects bound
	// directly to target.
	SearchTargetPolicyBindings(ctx context.Context, in *SearchTargetPolicyBindingsRequest, opts ...grpc.CallOption) (*SearchTargetPolicyBindingsResponse, error)
}

type PolicyBindingsServer interface {
	// Creates a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on both the policy and target.
	// Once the binding is created, the policy is applied to the target.
	CreatePolicyBinding(context.Context, *CreatePolicyBindingRequest) (*longrunningpb.Operation, error)
	// Gets a policy binding.
	GetPolicyBinding(context.Context, *GetPolicyBindingRequest) (*PolicyBinding, error)
	// Updates a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on the policy and target in the
	// binding to update, and the IAM permission to remove the existing policy
	// from the binding. Target is immutable and cannot be updated. Once the
	// binding is updated, the new policy is applied to the target.
	UpdatePolicyBinding(context.Context, *UpdatePolicyBindingRequest) (*longrunningpb.Operation, error)
	// Deletes a policy binding and returns a long-running operation.
	// Callers will need the IAM permissions on both the policy and target.
	// Once the binding is deleted, the policy no longer applies to the target.
	DeletePolicyBinding(context.Context, *DeletePolicyBindingRequest) (*longrunningpb.Operation, error)
	// Lists policy bindings.
	ListPolicyBindings(context.Context, *ListPolicyBindingsRequest) (*ListPolicyBindingsResponse, error)
	// Search policy bindings by target. Returns all policy binding objects bound
	// directly to target.
	SearchTargetPolicyBindings(context.Context, *SearchTargetPolicyBindingsRequest) (*SearchTargetPolicyBindingsResponse, error)
}

type PrincipalAccessBoundaryPoliciesClient interface {
	// Creates a principal access boundary policy, and returns a long running
	// operation.
	CreatePrincipalAccessBoundaryPolicy(ctx context.Context, in *CreatePrincipalAccessBoundaryPolicyRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Gets a principal access boundary policy.
	GetPrincipalAccessBoundaryPolicy(ctx context.Context, in *GetPrincipalAccessBoundaryPolicyRequest, opts ...grpc.CallOption) (*PrincipalAccessBoundaryPolicy, error)
	// Updates a principal access boundary policy.
	UpdatePrincipalAccessBoundaryPolicy(ctx context.Context, in *UpdatePrincipalAccessBoundaryPolicyRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Deletes a principal access boundary policy.
	DeletePrincipalAccessBoundaryPolicy(ctx context.Context, in *DeletePrincipalAccessBoundaryPolicyRequest, opts ...grpc.CallOption) (*longrunningpb.Operation, error)
	// Lists principal access boundary policies.
	ListPrincipalAccessBoundaryPolicies(ctx context.Context, in *ListPrincipalAccessBoundaryPoliciesRequest, opts ...grpc.CallOption) (*ListPrincipalAccessBoundaryPoliciesResponse, error)
	// Returns all policy bindings that bind a specific policy if a user has
	// searchPolicyBindings permission on that policy.
	SearchPrincipalAccessBoundaryPolicyBindings(ctx context.Context, in *SearchPrincipalAccessBoundaryPolicyBindingsRequest, opts ...grpc.CallOption) (*SearchPrincipalAccessBoundaryPolicyBindingsResponse, error)
}

type PrincipalAccessBoundaryPoliciesServer interface {
	// Creates a principal access boundary policy, and returns a long running
	// operation.
	CreatePrincipalAccessBoundaryPolicy(context.Context, *CreatePrincipalAccessBoundaryPolicyRequest) (*longrunningpb.Operation, error)
	// Gets a principal access boundary policy.
	GetPrincipalAccessBoundaryPolicy(context.Context, *GetPrincipalAccessBoundaryPolicyRequest) (*PrincipalAccessBoundaryPolicy, error)
	// Updates a principal access boundary policy.
	UpdatePrincipalAccessBoundaryPolicy(context.Context, *UpdatePrincipalAccessBoundaryPolicyRequest) (*longrunningpb.Operation, error)
	// Deletes a principal access boundary policy.
	DeletePrincipalAccessBoundaryPolicy(context.Context, *DeletePrincipalAccessBoundaryPolicyRequest) (*longrunningpb.Operation, error)
	// Lists principal access boundary policies.
	ListPrincipalAccessBoundaryPolicies(context.Context, *ListPrincipalAccessBoundaryPoliciesRequest) (*ListPrincipalAccessBoundaryPoliciesResponse, error)
	// Returns all policy bindings that bind a specific policy if a user has
	// searchPolicyBindings permission on that policy.
	SearchPrincipalAccessBoundaryPolicyBindings(context.Context, *SearchPrincipalAccessBoundaryPolicyBindingsRequest) (*SearchPrincipalAccessBoundaryPolicyBindingsResponse, error)
}

type PrincipalAccessBoundaryPolicy struct {

	// Identifier. The resource name of the principal access boundary policy.
	//
	// The following format is supported:
	// `organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{policy_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Output only. The globally unique ID of the principal access boundary
	// policy.
	Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"`
	// Optional. The etag for the principal access boundary.
	// If this is provided on update, it must match the server's etag.
	Etag string `protobuf:"bytes,3,opt,name=etag,proto3" json:"etag,omitempty"`
	// Optional. The description of the principal access boundary policy. Must be
	// less than or equal to 63 characters.
	DisplayName string `protobuf:"bytes,4,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Optional. User defined annotations. See
	// https://google.aip.dev/148#annotations for more details such as format and
	// size limitations
	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Output only. The time when the principal access boundary policy was
	// created.
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Output only. The time when the principal access boundary policy was most
	// recently updated.
	UpdateTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
	// Optional. The details for the principal access boundary policy.
	Details *PrincipalAccessBoundaryPolicyDetails `protobuf:"bytes,8,opt,name=details,proto3" json:"details,omitempty"`
	// contains filtered or unexported fields
}

type PrincipalAccessBoundaryPolicyDetails struct {

	// Required. A list of principal access boundary policy rules. The number of
	// rules in a policy is limited to 500.
	Rules []*PrincipalAccessBoundaryPolicyRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// Optional.
	// The version number (for example, `1` or `latest`) that indicates which
	// permissions are able to be blocked by the policy. If empty, the PAB policy
	// version will be set to the most recent version number at the time of the
	// policy's creation.
	EnforcementVersion string `protobuf:"bytes,4,opt,name=enforcement_version,json=enforcementVersion,proto3" json:"enforcement_version,omitempty"`
	// contains filtered or unexported fields
}

type PrincipalAccessBoundaryPolicyRule struct {

	// Optional. The description of the principal access boundary policy rule.
	// Must be less than or equal to 256 characters.
	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
	// Required. A list of Resource Manager resources. If a resource is listed in
	// the rule, then the rule applies for that resource and its descendants. The
	// number of resources in a policy is limited to 500 across all rules in the
	// policy.
	//
	// The following resource types are supported:
	//
	// * Organizations, such as
	// `//cloudresourcemanager.googleapis.com/organizations/123`.
	//   - Folders, such as `//cloudresourcemanager.googleapis.com/folders/123`.
	//   - Projects, such as `//cloudresourcemanager.googleapis.com/projects/123`
	//     or `//cloudresourcemanager.googleapis.com/projects/my-project-id`.
	Resources []string `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"`
	// Required. The access relationship of principals to the resources in this
	// rule.
	Effect PrincipalAccessBoundaryPolicyRule_Effect `protobuf:"varint,3,opt,name=effect,proto3,enum=google.iam.v3.PrincipalAccessBoundaryPolicyRule_Effect" json:"effect,omitempty"`
	// contains filtered or unexported fields
}

type PrincipalAccessBoundaryPolicyRule_Effect int32

const (
	// Effect unspecified.
	PrincipalAccessBoundaryPolicyRule_EFFECT_UNSPECIFIED PrincipalAccessBoundaryPolicyRule_Effect = 0
	// Allows access to the resources in this rule.
	PrincipalAccessBoundaryPolicyRule_ALLOW PrincipalAccessBoundaryPolicyRule_Effect = 1
)

type SearchPrincipalAccessBoundaryPolicyBindingsRequest struct {

	// Required. The name of the principal access boundary policy.
	// Format:
	//
	//	`organizations/{organization_id}/locations/{location}/principalAccessBoundaryPolicies/{principal_access_boundary_policy_id}`
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional. The maximum number of policy bindings to return. The service may
	// return fewer than this value.
	//
	// If unspecified, at most 50 policy bindings will be returned.
	// The maximum value is 1000; values above 1000 will be coerced to 1000.
	PageSize int32 `protobuf:"varint,3,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Optional. A page token, received from a previous
	// `SearchPrincipalAccessBoundaryPolicyBindingsRequest` call. Provide this to
	// retrieve the subsequent page.
	//
	// When paginating, all other parameters provided to
	// `SearchPrincipalAccessBoundaryPolicyBindingsRequest` must match the call
	// that provided the page token.
	PageToken string `protobuf:"bytes,4,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// contains filtered or unexported fields
}

type SearchPrincipalAccessBoundaryPolicyBindingsResponse struct {

	// The policy bindings that reference the specified policy.
	PolicyBindings []*PolicyBinding `protobuf:"bytes,1,rep,name=policy_bindings,json=policyBindings,proto3" json:"policy_bindings,omitempty"`
	// Optional. A token, which can be sent as `page_token` to retrieve the next
	// page. If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type SearchTargetPolicyBindingsRequest struct {

	// Required. The target resource, which is bound to the policy in the binding.
	//
	// Format:
	//
	// * `//iam.googleapis.com/locations/global/workforcePools/POOL_ID`
	// * `//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID`
	// * `//iam.googleapis.com/locations/global/workspace/WORKSPACE_ID`
	// * `//cloudresourcemanager.googleapis.com/projects/{project_number}`
	// * `//cloudresourcemanager.googleapis.com/folders/{folder_id}`
	// * `//cloudresourcemanager.googleapis.com/organizations/{organization_id}`
	Target string `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// Optional. The maximum number of policy bindings to return. The service may
	// return fewer than this value.
	//
	// If unspecified, at most 50 policy bindings will be returned.
	// The maximum value is 1000; values above 1000 will be coerced to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// Optional. A page token, received from a previous
	// `SearchTargetPolicyBindingsRequest` call. Provide this to retrieve the
	// subsequent page.
	//
	// When paginating, all other parameters provided to
	// `SearchTargetPolicyBindingsRequest` must match the call that provided the
	// page token.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Required. The parent resource where this search will be performed. This
	// should be the nearest Resource Manager resource (project, folder, or
	// organization) to the target.
	//
	// Format:
	//
	// * `projects/{project_id}/locations/{location}`
	// * `projects/{project_number}/locations/{location}`
	// * `folders/{folder_id}/locations/{location}`
	// * `organizations/{organization_id}/locations/{location}`
	Parent string `protobuf:"bytes,5,opt,name=parent,proto3" json:"parent,omitempty"`
	// contains filtered or unexported fields
}

type SearchTargetPolicyBindingsResponse struct {

	// The policy bindings bound to the specified target.
	PolicyBindings []*PolicyBinding `protobuf:"bytes,1,rep,name=policy_bindings,json=policyBindings,proto3" json:"policy_bindings,omitempty"`
	// Optional. A token, which can be sent as `page_token` to retrieve the next
	// page. If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedPolicyBindingsServer struct {
}

type UnimplementedPrincipalAccessBoundaryPoliciesServer struct {
}

type UpdatePolicyBindingRequest struct {

	// Required. The policy binding to update.
	//
	// The policy binding's `name` field is used to identify the policy binding to
	// update.
	PolicyBinding *PolicyBinding `protobuf:"bytes,1,opt,name=policy_binding,json=policyBinding,proto3" json:"policy_binding,omitempty"`
	// Optional. If set, validate the request and preview the update, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,2,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// Optional. The list of fields to update
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type UpdatePrincipalAccessBoundaryPolicyRequest struct {

	// Required. The principal access boundary policy to update.
	//
	// The principal access boundary policy's `name` field is used to identify the
	// policy to update.
	PrincipalAccessBoundaryPolicy *PrincipalAccessBoundaryPolicy `protobuf:"bytes,1,opt,name=principal_access_boundary_policy,json=principalAccessBoundaryPolicy,proto3" json:"principal_access_boundary_policy,omitempty"`
	// Optional. If set, validate the request and preview the update, but do not
	// actually post it.
	ValidateOnly bool `protobuf:"varint,2,opt,name=validate_only,json=validateOnly,proto3" json:"validate_only,omitempty"`
	// Optional. The list of fields to update
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}