Glossary term
IAM policy (allow policy)
The set of role bindings attached to a Google Cloud resource: who (members) has which role. Changed with SetIamPolicy and logged as bindingDeltas in audit logs.
An IAM allow policy is attached to a resource (organization, folder, project, bucket, service account, dataset…) and lists bindings: a role such as roles/owner and the members who hold it (user:, group:, serviceAccount:, domain:, or the special allUsers / allAuthenticatedUsers). The policy also carries auditConfigs, which control Data Access logging.
Changes go through SetIamPolicy (or service-specific methods like storage.setIamPermissions) and are recorded in Admin Activity logs with a diff in policyDelta.bindingDeltas (action, role, member) and auditConfigDeltas. Reading those deltas is how investigators find Owner grants to outsiders.