@kensio/yulin 1.20.11 → 1.20.13

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.d.ts

@@ -2,7 +2,7 @@ import type { SimArn } from "../../../aws/arn.js";
 import type { SimIamConditionValue, SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
 import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamAllowRequirement } from "../allow/sim-iam-allow-requirement.js";
-export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session";
+export type SimIamAuthZPolicySourceType = "identity-inline" | "identity-managed" | "resource" | "trust" | "permissions-boundary" | "session" | "service-control";
 export interface SimIamAuthZPolicySource {
     readonly sourceType: SimIamAuthZPolicySourceType;
     readonly document: SimIamPolicyDocument;
@@ -16,6 +16,29 @@ export interface SimIamAuthZPolicySource {
 export type SimIamAuthZResourcePolicySource = Omit<SimIamAuthZPolicySource, "sourceType"> & {
     readonly sourceType: Extract<SimIamAuthZPolicySourceType, "resource" | "trust">;
 };
+/**
+ * The service control policies attached at one level above the caller's
+ * Account, which is the root, an organizational unit, or the Account itself.
+ *
+ * Each level has to allow the action on its own. A level allowing nothing
+ * denies the request whatever another level allows, which is why the sources
+ * stay grouped rather than being read as one list.
+ */
+export interface SimIamAuthZServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly sources: readonly SimIamAuthZPolicySource[];
+}
+/**
+ * The service control policies in force for an authorization request.
+ *
+ * `applies` is a separate fact from how many levels there are. An Account
+ * inside an organization holding no policy allows nothing, while an Account
+ * outside every organization is unrestricted, and both can carry no levels.
+ */
+export interface SimIamAuthZServiceControlPolicies {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamAuthZServiceControlPolicyLevel[];
+}
 export interface SimIamAuthZContext {
     /**
      * Identity-based policies that grant permissions to the principal.
@@ -29,6 +52,13 @@ export interface SimIamAuthZContext {
      * Resource policies are not gathered from IAM's managed policy store.
      */
     readonly resourcePolicies: readonly SimIamAuthZPolicySource[];
+    /**
+     * Service control policies in force for the caller's Account.
+     *
+     * These filter what the Account's principals may do and grant nothing, so
+     * they are kept apart from the two sides that can allow a request.
+     */
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
     /**
      * How an Allow from each policy side combines into the final decision.
      *

package/dist/service/iam/authorize/context/sim-iam-auth-z-context.factory.js

@@ -6,6 +6,7 @@ import { SimIamEitherSideAllowRequirement } from "../allow/sim-iam-allow-require
 export const simIamAuthZContextFactory = new StaticFactory({
     identityPolicies: [],
     resourcePolicies: [],
+    serviceControlPolicies: { applies: false, levels: [] },
     allowRequirement: new SimIamEitherSideAllowRequirement(),
     action: "s3:GetObject",
     resource: "arn:aws:s3:::test-bucket/test-key",

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.d.ts

@@ -0,0 +1,46 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import type { SimIamServiceControlPolicyResolver } from "../scp/sim-iam-scp-resolver.js";
+import type { SimIamAuthZServiceControlPolicies } from "./sim-iam-auth-z-context.js";
+interface SimIamAuthZScpSourceBuilderProperties {
+    /**
+     * The Account whose IAM is evaluating the request.
+     */
+    readonly accountId: SimAwsAccountId;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
+}
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export declare class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    private static readonly unrestricted;
+    private readonly accountId;
+    private readonly scpResolver?;
+    constructor(properties: SimIamAuthZScpSourceBuilderProperties);
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller: SimAwsResolvedCaller): SimIamAuthZServiceControlPolicies;
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    private callerAccountId;
+}
+export {};

package/dist/service/iam/authorize/context/sim-iam-auth-z-scp-source-builder.js

@@ -0,0 +1,71 @@
+import { isSimAwsAccountId } from "../../../aws/sim-aws-account.js";
+/**
+ * Finds the service control policies that apply to one request.
+ *
+ * An SCP belongs to the caller's own Account, which is the Account whose
+ * principal is asking. For a request within one Account that is the Account
+ * evaluating it. For a cross-Account request it is the other one, because AWS
+ * filters a principal by the organization its own account sits in and leaves
+ * the resource's organization to say nothing about it.
+ *
+ * A caller with no Account in its ARN, which means a service principal or an
+ * anonymous request, belongs to no Account and is subject to no SCP.
+ */
+export class SimIamAuthZScpSourceBuilder {
+    /**
+     * What a caller no organization reaches is subject to.
+     */
+    static unrestricted = {
+        applies: false,
+        levels: [],
+    };
+    accountId;
+    scpResolver;
+    constructor(properties) {
+        this.accountId = properties.accountId;
+        this.scpResolver = properties.scpResolver;
+    }
+    /**
+     * The service control policies in force for a resolved caller.
+     */
+    build(caller) {
+        const scpResolver = this.scpResolver;
+        if (scpResolver === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const accountId = this.callerAccountId(caller);
+        if (accountId === undefined) {
+            return SimIamAuthZScpSourceBuilder.unrestricted;
+        }
+        const set = scpResolver.serviceControlPolicySetFor(accountId);
+        return {
+            applies: set.applies,
+            levels: set.levels.map((level) => ({
+                nodeName: level.nodeName,
+                sources: level.policies.map((policy) => ({
+                    sourceType: "service-control",
+                    document: policy.document,
+                    policyName: policy.policyName,
+                })),
+            })),
+        };
+    }
+    /**
+     * The Account whose organization decides this request.
+     *
+     * A caller identified only by a service name or by nothing at all has no
+     * Account of its own. The Account root fallback IAM applies to a request
+     * with no caller carries this Account's id, so a CloudFormation deployment
+     * is filtered like any other principal in it.
+     */
+    callerAccountId(caller) {
+        if (caller.principal.kind === "anonymous" || caller.service !== undefined) {
+            return undefined;
+        }
+        const callerAccountId = caller.accountId;
+        if (callerAccountId === undefined) {
+            return this.accountId;
+        }
+        return isSimAwsAccountId(callerAccountId) ? callerAccountId : undefined;
+    }
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.d.ts

@@ -0,0 +1,96 @@
+import type { SimIamPolicyDocumentStatement } from "../../policy/sim-iam-policy.js";
+import type { SimIamPolicyDocumentParser } from "../../policy/parse/sim-iam-document-parser.js";
+import type { SimIamPolicyStatementMatcher } from "../match/sim-iam-policy-statement-matcher.js";
+import type { SimIamAuthZServiceControlPolicies } from "../context/sim-iam-auth-z-context.js";
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+interface SimIamScpGateProperties {
+    readonly serviceControlPolicies: SimIamAuthZServiceControlPolicies;
+    readonly policyDocumentParser: SimIamPolicyDocumentParser;
+    readonly statementMatcher: SimIamPolicyStatementMatcher;
+}
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export declare class SimIamScpGate {
+    private readonly applies;
+    private readonly denyStatementRecords;
+    private readonly allowStatementRecords;
+    private readonly unallowedLevelNames;
+    constructor(properties: SimIamScpGateProperties);
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied(): boolean;
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny(): boolean;
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny(): boolean;
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied(): boolean;
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value(): SimIamPolicyDecisionValue | undefined;
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels(): readonly string[];
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action: string): string | undefined;
+    /**
+     * Record what one level of the organization said.
+     */
+    private evaluateLevel;
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    private evaluatePolicy;
+}
+export {};

package/dist/service/iam/authorize/scp/sim-iam-scp-gate.js

@@ -0,0 +1,148 @@
+import { SimIamPolicyDecisionValue } from "../sim-iam-decision-value.js";
+/**
+ * What an Account's service control policies say about one request.
+ *
+ * An SCP is a filter on the permissions an Account's principals can be given.
+ * It grants nothing, so this runs as a gate in front of the identity and
+ * resource policy evaluation instead of contributing Allows to it. The rules
+ * are the ones AWS applies at the Account boundary:
+ *
+ * - a matching Deny at any level ends the request;
+ * - every level between the root and the Account has to produce a matching
+ *   Allow of its own.
+ *
+ * The second rule is what makes the levels worth keeping apart. A root
+ * allowing S3 and an organizational unit allowing DynamoDB leave an Account
+ * beneath them able to do neither, because each level is asked separately.
+ *
+ * An Account outside any organization's reach is unrestricted, and this gate
+ * stands open for it. An Account inside one that holds no policy is a
+ * different case: nothing allows it anything, so the gate is shut.
+ */
+export class SimIamScpGate {
+    applies;
+    denyStatementRecords = [];
+    allowStatementRecords = [];
+    unallowedLevelNames = [];
+    constructor(properties) {
+        this.applies = properties.serviceControlPolicies.applies;
+        for (const level of properties.serviceControlPolicies.levels) {
+            this.evaluateLevel(level, properties);
+        }
+        if (this.applies && properties.serviceControlPolicies.levels.length === 0) {
+            this.unallowedLevelNames.push("the organization");
+        }
+    }
+    /**
+     * Whether any service control policy applied to this request at all.
+     */
+    get isApplied() {
+        return this.applies;
+    }
+    /**
+     * Whether an attached policy explicitly denied the request.
+     */
+    get isExplicitDeny() {
+        return this.denyStatementRecords.length > 0;
+    }
+    /**
+     * Whether a level left the request unallowed.
+     *
+     * A Deny is reported by `isExplicitDeny` and leaves this false, so the two
+     * name different denials and a reader can tell them apart.
+     */
+    get isImplicitDeny() {
+        return (this.applies &&
+            !this.isExplicitDeny &&
+            this.unallowedLevelNames.length > 0);
+    }
+    /**
+     * Whether the service control policies denied the request either way.
+     */
+    get isDenied() {
+        return this.isExplicitDeny || this.isImplicitDeny;
+    }
+    /**
+     * The decision this gate forces, where it forces one.
+     *
+     * Undefined leaves the request to the identity and resource policies, which
+     * is what an open gate means.
+     */
+    get value() {
+        if (this.isExplicitDeny) {
+            return SimIamPolicyDecisionValue.ExplicitDeny;
+        }
+        return this.isImplicitDeny
+            ? SimIamPolicyDecisionValue.ImplicitDeny
+            : undefined;
+    }
+    /**
+     * Matching Deny statements from the attached policies.
+     */
+    get denyStatements() {
+        return this.denyStatementRecords;
+    }
+    /**
+     * Matching Allow statements from the attached policies, across every level.
+     */
+    get allowStatements() {
+        return this.allowStatementRecords;
+    }
+    /**
+     * The levels that allowed nothing matching the request, root first.
+     *
+     * This is what a test reads to find which node in the organization is in the
+     * way, which is the part of an SCP denial AWS makes hardest to work out.
+     */
+    get unallowedLevels() {
+        return this.unallowedLevelNames;
+    }
+    /**
+     * How an AWS error explains this denial, if this gate is what denied it.
+     *
+     * The wording follows the AccessDenied messages AWS returns for the two
+     * cases, so a test asserting on the message reads what it would in a real
+     * account.
+     */
+    denialReason(action) {
+        if (this.isExplicitDeny) {
+            return "with an explicit deny in a service control policy";
+        }
+        if (this.isImplicitDeny) {
+            return `because no service control policy allows the ${action} action`;
+        }
+        return undefined;
+    }
+    /**
+     * Record what one level of the organization said.
+     */
+    evaluateLevel(level, properties) {
+        let allowed = false;
+        for (const policy of level.sources) {
+            allowed = this.evaluatePolicy(policy, properties) || allowed;
+        }
+        if (!allowed) {
+            this.unallowedLevelNames.push(level.nodeName);
+        }
+    }
+    /**
+     * Record the matching statements of one attached policy, and say whether it
+     * allowed the request.
+     */
+    evaluatePolicy(policy, properties) {
+        const parsedPolicy = properties.policyDocumentParser.parse(policy.document);
+        let allowed = false;
+        for (const statement of parsedPolicy.statements) {
+            if (!properties.statementMatcher.matches(policy, statement).matched) {
+                continue;
+            }
+            if (statement.effect === "Deny") {
+                this.denyStatementRecords.push(statement.source);
+                continue;
+            }
+            this.allowStatementRecords.push(statement.source);
+            allowed = true;
+        }
+        return allowed;
+    }
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.d.ts

@@ -0,0 +1,53 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimIamPolicyDocument } from "../../policy/sim-iam-policy.js";
+/**
+ * One service control policy applying to a simulated Account.
+ *
+ * The name travels with the document so a denial can say which policy produced
+ * it, the way an AWS denial names the policy in the console.
+ */
+export interface SimIamServiceControlPolicy {
+    readonly document: SimIamPolicyDocument;
+    readonly policyName?: string | undefined;
+}
+/**
+ * The policies attached at one level of the organization above an Account.
+ *
+ * AWS requires an Allow at every level between the root and the Account, so
+ * which level a policy came from decides the request rather than decorating
+ * it. The name is what a denial calls the level.
+ */
+export interface SimIamServiceControlPolicyLevel {
+    readonly nodeName: string;
+    readonly policies: readonly SimIamServiceControlPolicy[];
+}
+/**
+ * The service control policies in force for one Account.
+ *
+ * Whether any apply is a separate fact from how many levels there are. An
+ * Account whose every policy has been detached is still inside the
+ * organization, and nothing allowing an action there denies it. An Account
+ * outside every organization is unrestricted. Both can hold no policy, so the
+ * levels alone cannot tell them apart.
+ */
+export interface SimIamServiceControlPolicySet {
+    readonly applies: boolean;
+    readonly levels: readonly SimIamServiceControlPolicyLevel[];
+}
+/**
+ * Where sim IAM asks what an Account's organization allows it to do.
+ *
+ * IAM belongs to one Account and an organization spans several, so the
+ * organization is reached through this interface instead of being held by IAM
+ * itself. A standalone SimIam has no organization around it and leaves the
+ * resolver out, which is the same as an Account outside any organization.
+ */
+export interface SimIamServiceControlPolicyResolver {
+    /**
+     * The service control policies in force for an Account.
+     *
+     * A set that does not apply leaves the Account's identity and resource
+     * policies to decide the request on their own.
+     */
+    serviceControlPolicySetFor(accountId: SimAwsAccountId): SimIamServiceControlPolicySet;
+}

package/dist/service/iam/authorize/scp/sim-iam-scp-resolver.js

@@ -0,0 +1 @@
+export {};

package/dist/service/iam/authorize/sim-iam-account-auth-z.d.ts

@@ -10,6 +10,7 @@ import type { SimIamAuthorizationInput } from "./context/sim-iam-auth-z-context-
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
 import type { SimIamPolicyDecision } from "./sim-iam-decision.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAccountAuthZProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: Map<SimArn, SimIamManagedPolicy>;
@@ -24,6 +25,13 @@ interface SimIamAccountAuthZProperties {
      * standalone SimIam has no simulation around it and so no resolver.
      */
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    /**
+     * Resolves the service control policies in force for an Account.
+     *
+     * A simulation with an organization in it supplies this. A standalone SimIam
+     * has none, and its Accounts sit outside any organization.
+     */
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Evaluates IAM authorization attempts against one simulated Account's IAM

package/dist/service/iam/authorize/sim-iam-account-auth-z.js

@@ -39,6 +39,7 @@ export class SimIamAccountAuthZ {
             users: this.properties.users,
             credentialIdentityResolver: this.properties.credentialIdentityResolver,
             iamResolver: this.properties.iamResolver,
+            scpResolver: this.properties.scpResolver,
         });
     }
 }

package/dist/service/iam/authorize/sim-iam-action-authorizer.js

@@ -25,6 +25,7 @@ export class SimIamActionAuthorizer {
         if (decision.isDenied) {
             throw new SimIamAccessDenied({
                 principal: decision.caller.principal,
+                reason: decision.denialReason,
                 action,
                 resource,
             });

package/dist/service/iam/authorize/sim-iam-authorizer.d.ts

@@ -10,6 +10,7 @@ import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
 import type { SimIamAccountResolver } from "../registry/sim-iam-account-resolver.js";
 import type { SimIamAuthZPolicySource } from "./context/sim-iam-auth-z-context.js";
 import type { SimIamAccountIdentityPolicies } from "./identity/sim-iam-account-identity-policies.js";
+import type { SimIamServiceControlPolicyResolver } from "./scp/sim-iam-scp-resolver.js";
 interface SimIamAuthorizerProperties {
     readonly accountId: SimAwsAccountId;
     readonly policies: ReadonlyMap<SimArn, SimIamPolicy>;
@@ -17,6 +18,7 @@ interface SimIamAuthorizerProperties {
     readonly users: ReadonlyMap<SimIamUsername, SimIamUser>;
     readonly credentialIdentityResolver: SimAwsCredentialIdentityResolver;
     readonly iamResolver?: SimIamAccountResolver | undefined;
+    readonly scpResolver?: SimIamServiceControlPolicyResolver | undefined;
 }
 /**
  * Facade for simulated IAM authorization decisions.

package/dist/service/iam/authorize/sim-iam-authorizer.js

@@ -18,6 +18,7 @@ export class SimIamAuthorizer {
             users: properties.users,
             credentialIdentityResolver: properties.credentialIdentityResolver,
             iamResolver: properties.iamResolver,
+            scpResolver: properties.scpResolver,
         });
     }
     /**

package/dist/service/iam/authorize/sim-iam-decision-value.d.ts

@@ -0,0 +1,13 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export declare const SimIamPolicyDecisionValue: {
+    readonly ExplicitDeny: "ExplicitDeny";
+    readonly Allow: "Allow";
+    readonly ImplicitDeny: "ImplicitDeny";
+};
+export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];

package/dist/service/iam/authorize/sim-iam-decision-value.js

@@ -0,0 +1,12 @@
+/**
+ * What one simulated IAM authorization attempt came to.
+ *
+ * A denial is one of two things, and which one it is says what to change. An
+ * explicit deny means a statement matched and refused. An implicit deny means
+ * nothing allowed the request in the first place.
+ */
+export const SimIamPolicyDecisionValue = {
+    ExplicitDeny: "ExplicitDeny",
+    Allow: "Allow",
+    ImplicitDeny: "ImplicitDeny",
+};

package/dist/service/iam/authorize/sim-iam-decision.d.ts

@@ -2,36 +2,37 @@ import type { SimIamPolicyDocumentStatement } from "../policy/sim-iam-policy.js"
 import type { SimIamAuthZContext } from "./context/sim-iam-auth-z-context.js";
 import { SimIamPolicyDocumentParser } from "../policy/parse/sim-iam-document-parser.js";
 import type { SimAwsResolvedCaller } from "../../aws/caller/sim-aws-caller-resolver.js";
-export declare const SimIamPolicyDecisionValue: {
-    readonly ExplicitDeny: "ExplicitDeny";
-    readonly Allow: "Allow";
-    readonly ImplicitDeny: "ImplicitDeny";
-};
-export type SimIamPolicyDecisionValue = (typeof SimIamPolicyDecisionValue)[keyof typeof SimIamPolicyDecisionValue];
+import { SimIamScpGate } from "./scp/sim-iam-scp-gate.js";
+import { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
+export { SimIamPolicyDecisionValue } from "./sim-iam-decision-value.js";
 /**
  * Decision for one simulated IAM policy authorization attempt.
  *
- * This evaluates already-discovered identity and resource policy documents. It
- * does not fetch attached policies itself, apply trust policy semantics,
- * evaluate permissions boundaries, evaluate SCPs, or enforce service command
- * access.
+ * This evaluates already-discovered identity, resource, and service control
+ * policy documents. It does not fetch attached policies itself, apply trust
+ * policy semantics, evaluate permissions boundaries, or enforce service
+ * command access.
  *
  * The simulator currently models the common IAM authorization rules:
  *
  * - an explicit Deny in any evaluated policy wins;
+ * - the caller's Account has to get past its service control policies, which
+ *   filter permissions and grant none;
  * - the Allows found must satisfy the request's allow requirement, which is
  *   either side within one Account and both sides across Accounts;
  * - otherwise the request is implicitly denied.
  *
+ * Reading the policies belongs to SimIamPolicyEvaluation for the two sides
+ * that can allow, and to SimIamScpGate for the Account boundary. This class
+ * combines what they found.
+ *
  * Resource policies are expected to be supplied by the service that owns the
  * target resource.
  */
 export declare class SimIamPolicyDecision {
     private readonly request;
-    private readonly policyDocumentParser;
-    private readonly statementMatcher;
-    private readonly explicitDenyStatementRecords;
-    private readonly allows;
+    private readonly policies;
+    private readonly scpGate;
     constructor(request: SimIamAuthZContext, policyDocumentParser?: SimIamPolicyDocumentParser);
     /**
      * Resolved caller against which this authorization decision was evaluated.
@@ -70,6 +71,24 @@ export declare class SimIamPolicyDecision {
      * Matching explicit Deny statements.
      */
     get explicitDenyStatements(): readonly SimIamPolicyDocumentStatement[];
+    /**
+     * What the caller Account's service control policies said about the request.
+     *
+     * This is the organization's verdict on its own, apart from the identity and
+     * resource sides. It reports whether the Account boundary denied the request
+     * and which of its statements matched.
+     */
+    get serviceControlPolicy(): SimIamScpGate;
+    /**
+     * How an AccessDenied error should explain this denial, where there is more
+     * to say than the action and the resource.
+     *
+     * A service turns a denied decision into an error and passes this through,
+     * so an SCP denial reads the way it does in a real account. A matching Deny
+     * in an identity or resource policy is what `value` reports first, and it
+     * needs nothing added to the message, so it leaves this absent.
+     */
+    get denialReason(): string | undefined;
     /**
      * Matching Allow statements, from both policy sides.
      *
@@ -90,6 +109,4 @@ export declare class SimIamPolicyDecision {
      * Matching Allow statements originating from trust policies.
      */
     get trustAllowStatements(): readonly SimIamPolicyDocumentStatement[];
-    private evaluate;
-    private evaluatePolicy;
 }