FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Removing an invalid permission from the apply identity
Correcting the distinction between an API operation and an IAM permission while preserving least privilege
Purpose
The custom permissions for infrastructure application needed to contain only grantable IAM permissions and not accidentally include an API operation name.
Implementation
An API operation for generating a service identity had been listed as though it were a permission, so it was removed from the apply identity. Permission validation now rejects invalid entries of this kind, while required service-identity creation remains an explicit, separate bootstrap step.
The primary diff removed a REST method name that had been treated as a permission. This public account omits the full list and shows neighboring valid entries plus the absence condition.
What was confirmed
Verification results
The invalid permission was removed from the custom set, and checks now reject the same class of mistake.
At the cutoff, applying the corrected permissions to the external environment had not been verified.
Basis for completion
The work was complete when API operations and IAM permissions were correctly separated and the apply-identity definition and validation were corrected.