Struct GcpRuntimePermissionsGenerator 

pub struct GcpRuntimePermissionsGenerator;

GCP custom-role planner.

Implementations

impl GcpRuntimePermissionsGenerator

pub fn new() -> Self

Create a new GCP runtime permissions generator.

pub fn generate_custom_role( &self, permission_set: &PermissionSet, context: &PermissionContext, ) -> Result<GcpCustomRole>

Generate a custom role from a permission set.

GCP uses project custom roles for exact permission-set semantics. The role ID is derived from the deployment namespace and permission-set ID, so different service accounts in the same deployment share one role per permission-set entry without sharing roles across deployments.

pub fn generate_custom_roles( &self, permission_set: &PermissionSet, context: &PermissionContext, ) -> Result<Vec<GcpCustomRole>>

Generate one custom role per unique GCP permission entry.

Permission-set JSONC can split GCP permissions into multiple entries when some permissions must be bound at project scope and others at a resource scope. Keeping those entries as separate custom roles prevents project-scoped helper permissions from broadening resource permissions, and vice versa.

pub fn generate_bindings( &self, permission_set: &PermissionSet, binding_target: BindingTarget, context: &PermissionContext, ) -> Result<GcpIamBindings>

Generate IAM bindings from a permission set and binding target.

pub fn generate_grant_plan( &self, permission_set: &PermissionSet, binding_target: BindingTarget, context: &PermissionContext, ) -> Result<GcpGrantPlan>

Generate the full GCP grant plan from a permission set and binding target.