Org Policy Hierarchy Subtree Effective Evaluation

What Hierarchy Subtree Strings (under:) Are

A hierarchy subtree string is a specialized value format used in Google Cloud list constraints prefixed by under: (such as under:organizations/ID, under:folders/ID, or under:projects/ID). Its primary purpose is to apply policy rules broadly across a logical container and all existing or future child resources rooted beneath it, eliminating the operational overhead of listing every project ID individually.

How It Evaluates Across the Resource Hierarchy

1. Policy Attachment at Root: The organization policy is attached to the top-level node (organizations/1001). By default, child resources inherit policies from their parent containers.
2. Inheritance Cascading: Because neither folders/2001, folders/3001, eng-shared-tools, nor dev-backend define local overriding policies, they directly inherit the constraint rule from organizations/1001.
3. Subtree Evaluation: When Google Cloud evaluates the effective policy for eng-shared-tools (projects/4002), it detects that the project is an immediate child of folders/2001. For dev-backend (projects/4001), it evaluates ancestry up through folders/3001 to folders/2001. Because both resources reside within the hierarchy subtree rooted at folders/2001, the rule evaluates to denied for both.

Key Capabilities and Behaviors

• Deep Recursive Enforcement: The under: prefix acts on the designated resource and every nested descendant in the subtree, regardless of nesting depth.
• Dynamic Ingestion: New projects or nested folders created inside folders/2001 automatically inherit the denial without requiring policy modifications.
• Centralized Administration: Allows security administrators to enforce targeted boundaries from the organization root without delegating or scattering policies across lower-level folders.

Why This Evaluation Is Accurate

In Google Cloud Organization Policy hierarchy evaluation, list constraints evaluate against resource lineage. Because the subtree rule specifies under:folders/2001, all resources descended from folders/2001 inherit and match the denied value.