access object carries one key per resource the caller can actually
reach (statement, request, quota, data_table, report,
dashboard). Each key holds how broadly the caller sees that resource
(scope plus a plain-language description) and, for statements and
requests, the saved views they may pass to the matching list tool. A
resource the caller has no access to carries no key at all. If a key is
missing, do not try to query that resource.
The roles that reach every view of a resource through their access to the
whole resource category are listed once per resource, in category_roles.
They are not repeated in each view’s access.roles, which keeps only the
roles a view is shared with. To know every role that can read a view, combine
category_roles with that view’s access.roles.
Reports and dashboards report all or shared only, like quotas: each is
its own view, so a share names the resource itself. A caller who reaches a
report only through a shared dashboard carries no report key — the
values its tiles display are named in that dashboard’s description instead
of inventing a fifth scope.
Referenced from: get_identity,
get_role.
Shape
object
object
object
object
object
object