An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl) with a list of filter rules to approve or reject service account project role bindings. Examples: ``` Approve viewer and monitoring roles APPROVE $.turbot.role:=roles/viewer APPROVE $.turbot.role:=roles/monitoring.viewer Reject administrative roles REJECT $.turbot.role:=roles/owner REJECT $.turbot.role:=roles/editor Reject all other roles REJECT * ```

Azure > Management Group

Azure > Subscription

Azure > Tenant

Turbot > IAM > Turbot Identity

Turbot > IAM > Unidentified Identity

Azure > Active Directory > Directory

Kubernetes > Cluster

AWS > Account

GitHub > Repository

ServiceNow > Instance

GCP > Project

OCI > Compartment

AWS > Directory Service > Directory

AWS > Data Pipeline > Pipeline [Deprecated]

AWS > VPC > Flow Log

AWS > Region

AWS > EC2 > Instance

GCP > Folder

Azure > Resource Group

GCP > IAM > Service Account > Project Role Bindings > Approved

An [Object Control List (OCL)](https://turbot.com/guardrails/docs/reference/ocl)&#92;nwith a list of filter rules to approve or reject service account project role bindings.&#92;n&#92;nExamples:&#92;n  ```&#92;n  Approve viewer and monitoring roles&#92;n  APPROVE $.turbot.role:=roles/viewer&#92;n  APPROVE $.turbot.role:=roles/monitoring.viewer&#92;n&#92;n  Reject administrative roles&#92;n  REJECT $.turbot.role:=roles/owner&#92;n  REJECT $.turbot.role:=roles/editor&#92;n&#92;n  Reject all other roles&#92;n  REJECT *&#92;n  ```&#92;n

GCP > IAM > Service Account

GCP > IAM > Service Account > Project Role Bindings > Approved > Rules

Schema Type	`string`
Default	`# Approve unmatched roles APPROVE *`

Policy: GCP > IAM > Service Account > Project Role Bindings > Approved > Rules

Targets

Primary Policy

Controls

Policy Specification

Category

In Your Workspace

Developers