/*
 * Copyright 2026 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
// Generated by the protocol buffer compiler.  DO NOT EDIT!
// NO CHECKED-IN PROTOBUF GENCODE
// source: google/iam/v2/deny.proto
// Protobuf Java Version: 4.33.2

package com.google.iam.v2;

/**
 *
 *
 * <pre>
 * A deny rule in an IAM deny policy.
 * </pre>
 *
 * Protobuf type {@code google.iam.v2.DenyRule}
 */
@com.google.protobuf.Generated
public final class DenyRule extends com.google.protobuf.GeneratedMessage
    implements
    // @@protoc_insertion_point(message_implements:google.iam.v2.DenyRule)
    DenyRuleOrBuilder {
  private static final long serialVersionUID = 0L;

  static {
    com.google.protobuf.RuntimeVersion.validateProtobufGencodeVersion(
        com.google.protobuf.RuntimeVersion.RuntimeDomain.PUBLIC,
        /* major= */ 4,
        /* minor= */ 33,
        /* patch= */ 2,
        /* suffix= */ "",
        "DenyRule");
  }

  // Use DenyRule.newBuilder() to construct.
  private DenyRule(com.google.protobuf.GeneratedMessage.Builder<?> builder) {
    super(builder);
  }

  private DenyRule() {
    deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
    exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
    deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
    exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
  }

  public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    return com.google.iam.v2.DenyRuleProto.internal_static_google_iam_v2_DenyRule_descriptor;
  }

  @java.lang.Override
  protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
      internalGetFieldAccessorTable() {
    return com.google.iam.v2.DenyRuleProto.internal_static_google_iam_v2_DenyRule_fieldAccessorTable
        .ensureFieldAccessorsInitialized(
            com.google.iam.v2.DenyRule.class, com.google.iam.v2.DenyRule.Builder.class);
  }

  private int bitField0_;
  public static final int DENIED_PRINCIPALS_FIELD_NUMBER = 1;

  @SuppressWarnings("serial")
  private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
      com.google.protobuf.LazyStringArrayList.emptyList();

  /**
   *
   *
   * <pre>
   * The identities that are prevented from using one or more permissions on
   * Google Cloud resources. This field can contain the following values:
   *
   * * `principalSet://goog/public:all`: A special identifier that represents
   * any principal that is on the internet, even if they do not have a Google
   * Account or are not logged in.
   *
   * * `principal://goog/subject/{email_id}`: A specific Google Account.
   * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
   * example, `principal://goog/subject/alice&#64;example.com`.
   *
   * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
   * Google Account that was deleted recently. For example,
   * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
   * the Google Account is recovered, this identifier reverts to the standard
   * identifier for a Google Account.
   *
   * * `principalSet://goog/group/{group_id}`: A Google group. For example,
   * `principalSet://goog/group/admins&#64;example.com`.
   *
   * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
   * that was deleted recently. For example,
   * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
   * the Google group is restored, this identifier reverts to the standard
   * identifier for a Google group.
   *
   * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
   * A Google Cloud service account. For example,
   * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
   *
   * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
   * A Google Cloud service account that was deleted recently. For example,
   * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
   * If the service account is undeleted, this identifier reverts to the
   * standard identifier for a service account.
   *
   * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
   * principals associated with the specified Google Workspace or Cloud
   * Identity customer ID. For example,
   * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
   * </pre>
   *
   * <code>repeated string denied_principals = 1;</code>
   *
   * @return A list containing the deniedPrincipals.
   */
  public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
    return deniedPrincipals_;
  }

  /**
   *
   *
   * <pre>
   * The identities that are prevented from using one or more permissions on
   * Google Cloud resources. This field can contain the following values:
   *
   * * `principalSet://goog/public:all`: A special identifier that represents
   * any principal that is on the internet, even if they do not have a Google
   * Account or are not logged in.
   *
   * * `principal://goog/subject/{email_id}`: A specific Google Account.
   * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
   * example, `principal://goog/subject/alice&#64;example.com`.
   *
   * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
   * Google Account that was deleted recently. For example,
   * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
   * the Google Account is recovered, this identifier reverts to the standard
   * identifier for a Google Account.
   *
   * * `principalSet://goog/group/{group_id}`: A Google group. For example,
   * `principalSet://goog/group/admins&#64;example.com`.
   *
   * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
   * that was deleted recently. For example,
   * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
   * the Google group is restored, this identifier reverts to the standard
   * identifier for a Google group.
   *
   * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
   * A Google Cloud service account. For example,
   * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
   *
   * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
   * A Google Cloud service account that was deleted recently. For example,
   * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
   * If the service account is undeleted, this identifier reverts to the
   * standard identifier for a service account.
   *
   * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
   * principals associated with the specified Google Workspace or Cloud
   * Identity customer ID. For example,
   * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
   * </pre>
   *
   * <code>repeated string denied_principals = 1;</code>
   *
   * @return The count of deniedPrincipals.
   */
  public int getDeniedPrincipalsCount() {
    return deniedPrincipals_.size();
  }

  /**
   *
   *
   * <pre>
   * The identities that are prevented from using one or more permissions on
   * Google Cloud resources. This field can contain the following values:
   *
   * * `principalSet://goog/public:all`: A special identifier that represents
   * any principal that is on the internet, even if they do not have a Google
   * Account or are not logged in.
   *
   * * `principal://goog/subject/{email_id}`: A specific Google Account.
   * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
   * example, `principal://goog/subject/alice&#64;example.com`.
   *
   * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
   * Google Account that was deleted recently. For example,
   * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
   * the Google Account is recovered, this identifier reverts to the standard
   * identifier for a Google Account.
   *
   * * `principalSet://goog/group/{group_id}`: A Google group. For example,
   * `principalSet://goog/group/admins&#64;example.com`.
   *
   * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
   * that was deleted recently. For example,
   * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
   * the Google group is restored, this identifier reverts to the standard
   * identifier for a Google group.
   *
   * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
   * A Google Cloud service account. For example,
   * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
   *
   * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
   * A Google Cloud service account that was deleted recently. For example,
   * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
   * If the service account is undeleted, this identifier reverts to the
   * standard identifier for a service account.
   *
   * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
   * principals associated with the specified Google Workspace or Cloud
   * Identity customer ID. For example,
   * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
   * </pre>
   *
   * <code>repeated string denied_principals = 1;</code>
   *
   * @param index The index of the element to return.
   * @return The deniedPrincipals at the given index.
   */
  public java.lang.String getDeniedPrincipals(int index) {
    return deniedPrincipals_.get(index);
  }

  /**
   *
   *
   * <pre>
   * The identities that are prevented from using one or more permissions on
   * Google Cloud resources. This field can contain the following values:
   *
   * * `principalSet://goog/public:all`: A special identifier that represents
   * any principal that is on the internet, even if they do not have a Google
   * Account or are not logged in.
   *
   * * `principal://goog/subject/{email_id}`: A specific Google Account.
   * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
   * example, `principal://goog/subject/alice&#64;example.com`.
   *
   * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
   * Google Account that was deleted recently. For example,
   * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
   * the Google Account is recovered, this identifier reverts to the standard
   * identifier for a Google Account.
   *
   * * `principalSet://goog/group/{group_id}`: A Google group. For example,
   * `principalSet://goog/group/admins&#64;example.com`.
   *
   * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
   * that was deleted recently. For example,
   * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
   * the Google group is restored, this identifier reverts to the standard
   * identifier for a Google group.
   *
   * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
   * A Google Cloud service account. For example,
   * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
   *
   * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
   * A Google Cloud service account that was deleted recently. For example,
   * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
   * If the service account is undeleted, this identifier reverts to the
   * standard identifier for a service account.
   *
   * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
   * principals associated with the specified Google Workspace or Cloud
   * Identity customer ID. For example,
   * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
   * </pre>
   *
   * <code>repeated string denied_principals = 1;</code>
   *
   * @param index The index of the value to return.
   * @return The bytes of the deniedPrincipals at the given index.
   */
  public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
    return deniedPrincipals_.getByteString(index);
  }

  public static final int EXCEPTION_PRINCIPALS_FIELD_NUMBER = 2;

  @SuppressWarnings("serial")
  private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
      com.google.protobuf.LazyStringArrayList.emptyList();

  /**
   *
   *
   * <pre>
   * The identities that are excluded from the deny rule, even if they are
   * listed in the `denied_principals`. For example, you could add a Google
   * group to the `denied_principals`, then exclude specific users who belong to
   * that group.
   *
   * This field can contain the same values as the `denied_principals` field,
   * excluding `principalSet://goog/public:all`, which represents all users on
   * the internet.
   * </pre>
   *
   * <code>repeated string exception_principals = 2;</code>
   *
   * @return A list containing the exceptionPrincipals.
   */
  public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
    return exceptionPrincipals_;
  }

  /**
   *
   *
   * <pre>
   * The identities that are excluded from the deny rule, even if they are
   * listed in the `denied_principals`. For example, you could add a Google
   * group to the `denied_principals`, then exclude specific users who belong to
   * that group.
   *
   * This field can contain the same values as the `denied_principals` field,
   * excluding `principalSet://goog/public:all`, which represents all users on
   * the internet.
   * </pre>
   *
   * <code>repeated string exception_principals = 2;</code>
   *
   * @return The count of exceptionPrincipals.
   */
  public int getExceptionPrincipalsCount() {
    return exceptionPrincipals_.size();
  }

  /**
   *
   *
   * <pre>
   * The identities that are excluded from the deny rule, even if they are
   * listed in the `denied_principals`. For example, you could add a Google
   * group to the `denied_principals`, then exclude specific users who belong to
   * that group.
   *
   * This field can contain the same values as the `denied_principals` field,
   * excluding `principalSet://goog/public:all`, which represents all users on
   * the internet.
   * </pre>
   *
   * <code>repeated string exception_principals = 2;</code>
   *
   * @param index The index of the element to return.
   * @return The exceptionPrincipals at the given index.
   */
  public java.lang.String getExceptionPrincipals(int index) {
    return exceptionPrincipals_.get(index);
  }

  /**
   *
   *
   * <pre>
   * The identities that are excluded from the deny rule, even if they are
   * listed in the `denied_principals`. For example, you could add a Google
   * group to the `denied_principals`, then exclude specific users who belong to
   * that group.
   *
   * This field can contain the same values as the `denied_principals` field,
   * excluding `principalSet://goog/public:all`, which represents all users on
   * the internet.
   * </pre>
   *
   * <code>repeated string exception_principals = 2;</code>
   *
   * @param index The index of the value to return.
   * @return The bytes of the exceptionPrincipals at the given index.
   */
  public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
    return exceptionPrincipals_.getByteString(index);
  }

  public static final int DENIED_PERMISSIONS_FIELD_NUMBER = 3;

  @SuppressWarnings("serial")
  private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
      com.google.protobuf.LazyStringArrayList.emptyList();

  /**
   *
   *
   * <pre>
   * The permissions that are explicitly denied by this rule. Each permission
   * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
   * is the fully qualified domain name for the service. For example,
   * `iam.googleapis.com/roles.list`.
   * </pre>
   *
   * <code>repeated string denied_permissions = 3;</code>
   *
   * @return A list containing the deniedPermissions.
   */
  public com.google.protobuf.ProtocolStringList getDeniedPermissionsList() {
    return deniedPermissions_;
  }

  /**
   *
   *
   * <pre>
   * The permissions that are explicitly denied by this rule. Each permission
   * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
   * is the fully qualified domain name for the service. For example,
   * `iam.googleapis.com/roles.list`.
   * </pre>
   *
   * <code>repeated string denied_permissions = 3;</code>
   *
   * @return The count of deniedPermissions.
   */
  public int getDeniedPermissionsCount() {
    return deniedPermissions_.size();
  }

  /**
   *
   *
   * <pre>
   * The permissions that are explicitly denied by this rule. Each permission
   * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
   * is the fully qualified domain name for the service. For example,
   * `iam.googleapis.com/roles.list`.
   * </pre>
   *
   * <code>repeated string denied_permissions = 3;</code>
   *
   * @param index The index of the element to return.
   * @return The deniedPermissions at the given index.
   */
  public java.lang.String getDeniedPermissions(int index) {
    return deniedPermissions_.get(index);
  }

  /**
   *
   *
   * <pre>
   * The permissions that are explicitly denied by this rule. Each permission
   * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
   * is the fully qualified domain name for the service. For example,
   * `iam.googleapis.com/roles.list`.
   * </pre>
   *
   * <code>repeated string denied_permissions = 3;</code>
   *
   * @param index The index of the value to return.
   * @return The bytes of the deniedPermissions at the given index.
   */
  public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
    return deniedPermissions_.getByteString(index);
  }

  public static final int EXCEPTION_PERMISSIONS_FIELD_NUMBER = 4;

  @SuppressWarnings("serial")
  private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
      com.google.protobuf.LazyStringArrayList.emptyList();

  /**
   *
   *
   * <pre>
   * Specifies the permissions that this rule excludes from the set of denied
   * permissions given by `denied_permissions`. If a permission appears in
   * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
   * denied.
   *
   * The excluded permissions can be specified using the same syntax as
   * `denied_permissions`.
   * </pre>
   *
   * <code>repeated string exception_permissions = 4;</code>
   *
   * @return A list containing the exceptionPermissions.
   */
  public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
    return exceptionPermissions_;
  }

  /**
   *
   *
   * <pre>
   * Specifies the permissions that this rule excludes from the set of denied
   * permissions given by `denied_permissions`. If a permission appears in
   * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
   * denied.
   *
   * The excluded permissions can be specified using the same syntax as
   * `denied_permissions`.
   * </pre>
   *
   * <code>repeated string exception_permissions = 4;</code>
   *
   * @return The count of exceptionPermissions.
   */
  public int getExceptionPermissionsCount() {
    return exceptionPermissions_.size();
  }

  /**
   *
   *
   * <pre>
   * Specifies the permissions that this rule excludes from the set of denied
   * permissions given by `denied_permissions`. If a permission appears in
   * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
   * denied.
   *
   * The excluded permissions can be specified using the same syntax as
   * `denied_permissions`.
   * </pre>
   *
   * <code>repeated string exception_permissions = 4;</code>
   *
   * @param index The index of the element to return.
   * @return The exceptionPermissions at the given index.
   */
  public java.lang.String getExceptionPermissions(int index) {
    return exceptionPermissions_.get(index);
  }

  /**
   *
   *
   * <pre>
   * Specifies the permissions that this rule excludes from the set of denied
   * permissions given by `denied_permissions`. If a permission appears in
   * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
   * denied.
   *
   * The excluded permissions can be specified using the same syntax as
   * `denied_permissions`.
   * </pre>
   *
   * <code>repeated string exception_permissions = 4;</code>
   *
   * @param index The index of the value to return.
   * @return The bytes of the exceptionPermissions at the given index.
   */
  public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
    return exceptionPermissions_.getByteString(index);
  }

  public static final int DENIAL_CONDITION_FIELD_NUMBER = 5;
  private com.google.type.Expr denialCondition_;

  /**
   *
   *
   * <pre>
   * The condition that determines whether this deny rule applies to a request.
   * If the condition expression evaluates to `true`, then the deny rule is
   * applied; otherwise, the deny rule is not applied.
   *
   * Each deny rule is evaluated independently. If this deny rule does not apply
   * to a request, other deny rules might still apply.
   *
   * The condition can use CEL functions that evaluate
   * [resource
   * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
   * functions and operators are not supported.
   * </pre>
   *
   * <code>.google.type.Expr denial_condition = 5;</code>
   *
   * @return Whether the denialCondition field is set.
   */
  @java.lang.Override
  public boolean hasDenialCondition() {
    return ((bitField0_ & 0x00000001) != 0);
  }

  /**
   *
   *
   * <pre>
   * The condition that determines whether this deny rule applies to a request.
   * If the condition expression evaluates to `true`, then the deny rule is
   * applied; otherwise, the deny rule is not applied.
   *
   * Each deny rule is evaluated independently. If this deny rule does not apply
   * to a request, other deny rules might still apply.
   *
   * The condition can use CEL functions that evaluate
   * [resource
   * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
   * functions and operators are not supported.
   * </pre>
   *
   * <code>.google.type.Expr denial_condition = 5;</code>
   *
   * @return The denialCondition.
   */
  @java.lang.Override
  public com.google.type.Expr getDenialCondition() {
    return denialCondition_ == null ? com.google.type.Expr.getDefaultInstance() : denialCondition_;
  }

  /**
   *
   *
   * <pre>
   * The condition that determines whether this deny rule applies to a request.
   * If the condition expression evaluates to `true`, then the deny rule is
   * applied; otherwise, the deny rule is not applied.
   *
   * Each deny rule is evaluated independently. If this deny rule does not apply
   * to a request, other deny rules might still apply.
   *
   * The condition can use CEL functions that evaluate
   * [resource
   * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
   * functions and operators are not supported.
   * </pre>
   *
   * <code>.google.type.Expr denial_condition = 5;</code>
   */
  @java.lang.Override
  public com.google.type.ExprOrBuilder getDenialConditionOrBuilder() {
    return denialCondition_ == null ? com.google.type.Expr.getDefaultInstance() : denialCondition_;
  }

  private byte memoizedIsInitialized = -1;

  @java.lang.Override
  public final boolean isInitialized() {
    byte isInitialized = memoizedIsInitialized;
    if (isInitialized == 1) return true;
    if (isInitialized == 0) return false;

    memoizedIsInitialized = 1;
    return true;
  }

  @java.lang.Override
  public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io.IOException {
    for (int i = 0; i < deniedPrincipals_.size(); i++) {
      com.google.protobuf.GeneratedMessage.writeString(output, 1, deniedPrincipals_.getRaw(i));
    }
    for (int i = 0; i < exceptionPrincipals_.size(); i++) {
      com.google.protobuf.GeneratedMessage.writeString(output, 2, exceptionPrincipals_.getRaw(i));
    }
    for (int i = 0; i < deniedPermissions_.size(); i++) {
      com.google.protobuf.GeneratedMessage.writeString(output, 3, deniedPermissions_.getRaw(i));
    }
    for (int i = 0; i < exceptionPermissions_.size(); i++) {
      com.google.protobuf.GeneratedMessage.writeString(output, 4, exceptionPermissions_.getRaw(i));
    }
    if (((bitField0_ & 0x00000001) != 0)) {
      output.writeMessage(5, getDenialCondition());
    }
    getUnknownFields().writeTo(output);
  }

  @java.lang.Override
  public int getSerializedSize() {
    int size = memoizedSize;
    if (size != -1) return size;

    size = 0;
    {
      int dataSize = 0;
      for (int i = 0; i < deniedPrincipals_.size(); i++) {
        dataSize += computeStringSizeNoTag(deniedPrincipals_.getRaw(i));
      }
      size += dataSize;
      size += 1 * getDeniedPrincipalsList().size();
    }
    {
      int dataSize = 0;
      for (int i = 0; i < exceptionPrincipals_.size(); i++) {
        dataSize += computeStringSizeNoTag(exceptionPrincipals_.getRaw(i));
      }
      size += dataSize;
      size += 1 * getExceptionPrincipalsList().size();
    }
    {
      int dataSize = 0;
      for (int i = 0; i < deniedPermissions_.size(); i++) {
        dataSize += computeStringSizeNoTag(deniedPermissions_.getRaw(i));
      }
      size += dataSize;
      size += 1 * getDeniedPermissionsList().size();
    }
    {
      int dataSize = 0;
      for (int i = 0; i < exceptionPermissions_.size(); i++) {
        dataSize += computeStringSizeNoTag(exceptionPermissions_.getRaw(i));
      }
      size += dataSize;
      size += 1 * getExceptionPermissionsList().size();
    }
    if (((bitField0_ & 0x00000001) != 0)) {
      size += com.google.protobuf.CodedOutputStream.computeMessageSize(5, getDenialCondition());
    }
    size += getUnknownFields().getSerializedSize();
    memoizedSize = size;
    return size;
  }

  @java.lang.Override
  public boolean equals(final java.lang.Object obj) {
    if (obj == this) {
      return true;
    }
    if (!(obj instanceof com.google.iam.v2.DenyRule)) {
      return super.equals(obj);
    }
    com.google.iam.v2.DenyRule other = (com.google.iam.v2.DenyRule) obj;

    if (!getDeniedPrincipalsList().equals(other.getDeniedPrincipalsList())) return false;
    if (!getExceptionPrincipalsList().equals(other.getExceptionPrincipalsList())) return false;
    if (!getDeniedPermissionsList().equals(other.getDeniedPermissionsList())) return false;
    if (!getExceptionPermissionsList().equals(other.getExceptionPermissionsList())) return false;
    if (hasDenialCondition() != other.hasDenialCondition()) return false;
    if (hasDenialCondition()) {
      if (!getDenialCondition().equals(other.getDenialCondition())) return false;
    }
    if (!getUnknownFields().equals(other.getUnknownFields())) return false;
    return true;
  }

  @java.lang.Override
  public int hashCode() {
    if (memoizedHashCode != 0) {
      return memoizedHashCode;
    }
    int hash = 41;
    hash = (19 * hash) + getDescriptor().hashCode();
    if (getDeniedPrincipalsCount() > 0) {
      hash = (37 * hash) + DENIED_PRINCIPALS_FIELD_NUMBER;
      hash = (53 * hash) + getDeniedPrincipalsList().hashCode();
    }
    if (getExceptionPrincipalsCount() > 0) {
      hash = (37 * hash) + EXCEPTION_PRINCIPALS_FIELD_NUMBER;
      hash = (53 * hash) + getExceptionPrincipalsList().hashCode();
    }
    if (getDeniedPermissionsCount() > 0) {
      hash = (37 * hash) + DENIED_PERMISSIONS_FIELD_NUMBER;
      hash = (53 * hash) + getDeniedPermissionsList().hashCode();
    }
    if (getExceptionPermissionsCount() > 0) {
      hash = (37 * hash) + EXCEPTION_PERMISSIONS_FIELD_NUMBER;
      hash = (53 * hash) + getExceptionPermissionsList().hashCode();
    }
    if (hasDenialCondition()) {
      hash = (37 * hash) + DENIAL_CONDITION_FIELD_NUMBER;
      hash = (53 * hash) + getDenialCondition().hashCode();
    }
    hash = (29 * hash) + getUnknownFields().hashCode();
    memoizedHashCode = hash;
    return hash;
  }

  public static com.google.iam.v2.DenyRule parseFrom(java.nio.ByteBuffer data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }

  public static com.google.iam.v2.DenyRule parseFrom(
      java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }

  public static com.google.iam.v2.DenyRule parseFrom(com.google.protobuf.ByteString data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }

  public static com.google.iam.v2.DenyRule parseFrom(
      com.google.protobuf.ByteString data,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }

  public static com.google.iam.v2.DenyRule parseFrom(byte[] data)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data);
  }

  public static com.google.iam.v2.DenyRule parseFrom(
      byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws com.google.protobuf.InvalidProtocolBufferException {
    return PARSER.parseFrom(data, extensionRegistry);
  }

  public static com.google.iam.v2.DenyRule parseFrom(java.io.InputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseWithIOException(PARSER, input);
  }

  public static com.google.iam.v2.DenyRule parseFrom(
      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseWithIOException(
        PARSER, input, extensionRegistry);
  }

  public static com.google.iam.v2.DenyRule parseDelimitedFrom(java.io.InputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseDelimitedWithIOException(PARSER, input);
  }

  public static com.google.iam.v2.DenyRule parseDelimitedFrom(
      java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseDelimitedWithIOException(
        PARSER, input, extensionRegistry);
  }

  public static com.google.iam.v2.DenyRule parseFrom(com.google.protobuf.CodedInputStream input)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseWithIOException(PARSER, input);
  }

  public static com.google.iam.v2.DenyRule parseFrom(
      com.google.protobuf.CodedInputStream input,
      com.google.protobuf.ExtensionRegistryLite extensionRegistry)
      throws java.io.IOException {
    return com.google.protobuf.GeneratedMessage.parseWithIOException(
        PARSER, input, extensionRegistry);
  }

  @java.lang.Override
  public Builder newBuilderForType() {
    return newBuilder();
  }

  public static Builder newBuilder() {
    return DEFAULT_INSTANCE.toBuilder();
  }

  public static Builder newBuilder(com.google.iam.v2.DenyRule prototype) {
    return DEFAULT_INSTANCE.toBuilder().mergeFrom(prototype);
  }

  @java.lang.Override
  public Builder toBuilder() {
    return this == DEFAULT_INSTANCE ? new Builder() : new Builder().mergeFrom(this);
  }

  @java.lang.Override
  protected Builder newBuilderForType(com.google.protobuf.GeneratedMessage.BuilderParent parent) {
    Builder builder = new Builder(parent);
    return builder;
  }

  /**
   *
   *
   * <pre>
   * A deny rule in an IAM deny policy.
   * </pre>
   *
   * Protobuf type {@code google.iam.v2.DenyRule}
   */
  public static final class Builder extends com.google.protobuf.GeneratedMessage.Builder<Builder>
      implements
      // @@protoc_insertion_point(builder_implements:google.iam.v2.DenyRule)
      com.google.iam.v2.DenyRuleOrBuilder {
    public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
      return com.google.iam.v2.DenyRuleProto.internal_static_google_iam_v2_DenyRule_descriptor;
    }

    @java.lang.Override
    protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
        internalGetFieldAccessorTable() {
      return com.google.iam.v2.DenyRuleProto
          .internal_static_google_iam_v2_DenyRule_fieldAccessorTable
          .ensureFieldAccessorsInitialized(
              com.google.iam.v2.DenyRule.class, com.google.iam.v2.DenyRule.Builder.class);
    }

    // Construct using com.google.iam.v2.DenyRule.newBuilder()
    private Builder() {
      maybeForceBuilderInitialization();
    }

    private Builder(com.google.protobuf.GeneratedMessage.BuilderParent parent) {
      super(parent);
      maybeForceBuilderInitialization();
    }

    private void maybeForceBuilderInitialization() {
      if (com.google.protobuf.GeneratedMessage.alwaysUseFieldBuilders) {
        internalGetDenialConditionFieldBuilder();
      }
    }

    @java.lang.Override
    public Builder clear() {
      super.clear();
      bitField0_ = 0;
      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
      denialCondition_ = null;
      if (denialConditionBuilder_ != null) {
        denialConditionBuilder_.dispose();
        denialConditionBuilder_ = null;
      }
      return this;
    }

    @java.lang.Override
    public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
      return com.google.iam.v2.DenyRuleProto.internal_static_google_iam_v2_DenyRule_descriptor;
    }

    @java.lang.Override
    public com.google.iam.v2.DenyRule getDefaultInstanceForType() {
      return com.google.iam.v2.DenyRule.getDefaultInstance();
    }

    @java.lang.Override
    public com.google.iam.v2.DenyRule build() {
      com.google.iam.v2.DenyRule result = buildPartial();
      if (!result.isInitialized()) {
        throw newUninitializedMessageException(result);
      }
      return result;
    }

    @java.lang.Override
    public com.google.iam.v2.DenyRule buildPartial() {
      com.google.iam.v2.DenyRule result = new com.google.iam.v2.DenyRule(this);
      if (bitField0_ != 0) {
        buildPartial0(result);
      }
      onBuilt();
      return result;
    }

    private void buildPartial0(com.google.iam.v2.DenyRule result) {
      int from_bitField0_ = bitField0_;
      if (((from_bitField0_ & 0x00000001) != 0)) {
        deniedPrincipals_.makeImmutable();
        result.deniedPrincipals_ = deniedPrincipals_;
      }
      if (((from_bitField0_ & 0x00000002) != 0)) {
        exceptionPrincipals_.makeImmutable();
        result.exceptionPrincipals_ = exceptionPrincipals_;
      }
      if (((from_bitField0_ & 0x00000004) != 0)) {
        deniedPermissions_.makeImmutable();
        result.deniedPermissions_ = deniedPermissions_;
      }
      if (((from_bitField0_ & 0x00000008) != 0)) {
        exceptionPermissions_.makeImmutable();
        result.exceptionPermissions_ = exceptionPermissions_;
      }
      int to_bitField0_ = 0;
      if (((from_bitField0_ & 0x00000010) != 0)) {
        result.denialCondition_ =
            denialConditionBuilder_ == null ? denialCondition_ : denialConditionBuilder_.build();
        to_bitField0_ |= 0x00000001;
      }
      result.bitField0_ |= to_bitField0_;
    }

    @java.lang.Override
    public Builder mergeFrom(com.google.protobuf.Message other) {
      if (other instanceof com.google.iam.v2.DenyRule) {
        return mergeFrom((com.google.iam.v2.DenyRule) other);
      } else {
        super.mergeFrom(other);
        return this;
      }
    }

    public Builder mergeFrom(com.google.iam.v2.DenyRule other) {
      if (other == com.google.iam.v2.DenyRule.getDefaultInstance()) return this;
      if (!other.deniedPrincipals_.isEmpty()) {
        if (deniedPrincipals_.isEmpty()) {
          deniedPrincipals_ = other.deniedPrincipals_;
          bitField0_ |= 0x00000001;
        } else {
          ensureDeniedPrincipalsIsMutable();
          deniedPrincipals_.addAll(other.deniedPrincipals_);
        }
        onChanged();
      }
      if (!other.exceptionPrincipals_.isEmpty()) {
        if (exceptionPrincipals_.isEmpty()) {
          exceptionPrincipals_ = other.exceptionPrincipals_;
          bitField0_ |= 0x00000002;
        } else {
          ensureExceptionPrincipalsIsMutable();
          exceptionPrincipals_.addAll(other.exceptionPrincipals_);
        }
        onChanged();
      }
      if (!other.deniedPermissions_.isEmpty()) {
        if (deniedPermissions_.isEmpty()) {
          deniedPermissions_ = other.deniedPermissions_;
          bitField0_ |= 0x00000004;
        } else {
          ensureDeniedPermissionsIsMutable();
          deniedPermissions_.addAll(other.deniedPermissions_);
        }
        onChanged();
      }
      if (!other.exceptionPermissions_.isEmpty()) {
        if (exceptionPermissions_.isEmpty()) {
          exceptionPermissions_ = other.exceptionPermissions_;
          bitField0_ |= 0x00000008;
        } else {
          ensureExceptionPermissionsIsMutable();
          exceptionPermissions_.addAll(other.exceptionPermissions_);
        }
        onChanged();
      }
      if (other.hasDenialCondition()) {
        mergeDenialCondition(other.getDenialCondition());
      }
      this.mergeUnknownFields(other.getUnknownFields());
      onChanged();
      return this;
    }

    @java.lang.Override
    public final boolean isInitialized() {
      return true;
    }

    @java.lang.Override
    public Builder mergeFrom(
        com.google.protobuf.CodedInputStream input,
        com.google.protobuf.ExtensionRegistryLite extensionRegistry)
        throws java.io.IOException {
      if (extensionRegistry == null) {
        throw new java.lang.NullPointerException();
      }
      try {
        boolean done = false;
        while (!done) {
          int tag = input.readTag();
          switch (tag) {
            case 0:
              done = true;
              break;
            case 10:
              {
                java.lang.String s = input.readStringRequireUtf8();
                ensureDeniedPrincipalsIsMutable();
                deniedPrincipals_.add(s);
                break;
              } // case 10
            case 18:
              {
                java.lang.String s = input.readStringRequireUtf8();
                ensureExceptionPrincipalsIsMutable();
                exceptionPrincipals_.add(s);
                break;
              } // case 18
            case 26:
              {
                java.lang.String s = input.readStringRequireUtf8();
                ensureDeniedPermissionsIsMutable();
                deniedPermissions_.add(s);
                break;
              } // case 26
            case 34:
              {
                java.lang.String s = input.readStringRequireUtf8();
                ensureExceptionPermissionsIsMutable();
                exceptionPermissions_.add(s);
                break;
              } // case 34
            case 42:
              {
                input.readMessage(
                    internalGetDenialConditionFieldBuilder().getBuilder(), extensionRegistry);
                bitField0_ |= 0x00000010;
                break;
              } // case 42
            default:
              {
                if (!super.parseUnknownField(input, extensionRegistry, tag)) {
                  done = true; // was an endgroup tag
                }
                break;
              } // default:
          } // switch (tag)
        } // while (!done)
      } catch (com.google.protobuf.InvalidProtocolBufferException e) {
        throw e.unwrapIOException();
      } finally {
        onChanged();
      } // finally
      return this;
    }

    private int bitField0_;

    private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
        com.google.protobuf.LazyStringArrayList.emptyList();

    private void ensureDeniedPrincipalsIsMutable() {
      if (!deniedPrincipals_.isModifiable()) {
        deniedPrincipals_ = new com.google.protobuf.LazyStringArrayList(deniedPrincipals_);
      }
      bitField0_ |= 0x00000001;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @return A list containing the deniedPrincipals.
     */
    public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
      deniedPrincipals_.makeImmutable();
      return deniedPrincipals_;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @return The count of deniedPrincipals.
     */
    public int getDeniedPrincipalsCount() {
      return deniedPrincipals_.size();
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param index The index of the element to return.
     * @return The deniedPrincipals at the given index.
     */
    public java.lang.String getDeniedPrincipals(int index) {
      return deniedPrincipals_.get(index);
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param index The index of the value to return.
     * @return The bytes of the deniedPrincipals at the given index.
     */
    public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
      return deniedPrincipals_.getByteString(index);
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param index The index to set the value at.
     * @param value The deniedPrincipals to set.
     * @return This builder for chaining.
     */
    public Builder setDeniedPrincipals(int index, java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureDeniedPrincipalsIsMutable();
      deniedPrincipals_.set(index, value);
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param value The deniedPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addDeniedPrincipals(java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureDeniedPrincipalsIsMutable();
      deniedPrincipals_.add(value);
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param values The deniedPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> values) {
      ensureDeniedPrincipalsIsMutable();
      com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPrincipals_);
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @return This builder for chaining.
     */
    public Builder clearDeniedPrincipals() {
      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
      bitField0_ = (bitField0_ & ~0x00000001);
      ;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are prevented from using one or more permissions on
     * Google Cloud resources. This field can contain the following values:
     *
     * * `principalSet://goog/public:all`: A special identifier that represents
     * any principal that is on the internet, even if they do not have a Google
     * Account or are not logged in.
     *
     * * `principal://goog/subject/{email_id}`: A specific Google Account.
     * Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
     * example, `principal://goog/subject/alice&#64;example.com`.
     *
     * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
     * Google Account that was deleted recently. For example,
     * `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
     * the Google Account is recovered, this identifier reverts to the standard
     * identifier for a Google Account.
     *
     * * `principalSet://goog/group/{group_id}`: A Google group. For example,
     * `principalSet://goog/group/admins&#64;example.com`.
     *
     * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
     * that was deleted recently. For example,
     * `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
     * the Google group is restored, this identifier reverts to the standard
     * identifier for a Google group.
     *
     * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
     * A Google Cloud service account. For example,
     * `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
     *
     * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
     * A Google Cloud service account that was deleted recently. For example,
     * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
     * If the service account is undeleted, this identifier reverts to the
     * standard identifier for a service account.
     *
     * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
     * principals associated with the specified Google Workspace or Cloud
     * Identity customer ID. For example,
     * `principalSet://goog/cloudIdentityCustomerId/C01Abc35`.
     * </pre>
     *
     * <code>repeated string denied_principals = 1;</code>
     *
     * @param value The bytes of the deniedPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addDeniedPrincipalsBytes(com.google.protobuf.ByteString value) {
      if (value == null) {
        throw new NullPointerException();
      }
      checkByteStringIsUtf8(value);
      ensureDeniedPrincipalsIsMutable();
      deniedPrincipals_.add(value);
      bitField0_ |= 0x00000001;
      onChanged();
      return this;
    }

    private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
        com.google.protobuf.LazyStringArrayList.emptyList();

    private void ensureExceptionPrincipalsIsMutable() {
      if (!exceptionPrincipals_.isModifiable()) {
        exceptionPrincipals_ = new com.google.protobuf.LazyStringArrayList(exceptionPrincipals_);
      }
      bitField0_ |= 0x00000002;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @return A list containing the exceptionPrincipals.
     */
    public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
      exceptionPrincipals_.makeImmutable();
      return exceptionPrincipals_;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @return The count of exceptionPrincipals.
     */
    public int getExceptionPrincipalsCount() {
      return exceptionPrincipals_.size();
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param index The index of the element to return.
     * @return The exceptionPrincipals at the given index.
     */
    public java.lang.String getExceptionPrincipals(int index) {
      return exceptionPrincipals_.get(index);
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param index The index of the value to return.
     * @return The bytes of the exceptionPrincipals at the given index.
     */
    public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
      return exceptionPrincipals_.getByteString(index);
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param index The index to set the value at.
     * @param value The exceptionPrincipals to set.
     * @return This builder for chaining.
     */
    public Builder setExceptionPrincipals(int index, java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureExceptionPrincipalsIsMutable();
      exceptionPrincipals_.set(index, value);
      bitField0_ |= 0x00000002;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param value The exceptionPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addExceptionPrincipals(java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureExceptionPrincipalsIsMutable();
      exceptionPrincipals_.add(value);
      bitField0_ |= 0x00000002;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param values The exceptionPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> values) {
      ensureExceptionPrincipalsIsMutable();
      com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPrincipals_);
      bitField0_ |= 0x00000002;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @return This builder for chaining.
     */
    public Builder clearExceptionPrincipals() {
      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
      bitField0_ = (bitField0_ & ~0x00000002);
      ;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The identities that are excluded from the deny rule, even if they are
     * listed in the `denied_principals`. For example, you could add a Google
     * group to the `denied_principals`, then exclude specific users who belong to
     * that group.
     *
     * This field can contain the same values as the `denied_principals` field,
     * excluding `principalSet://goog/public:all`, which represents all users on
     * the internet.
     * </pre>
     *
     * <code>repeated string exception_principals = 2;</code>
     *
     * @param value The bytes of the exceptionPrincipals to add.
     * @return This builder for chaining.
     */
    public Builder addExceptionPrincipalsBytes(com.google.protobuf.ByteString value) {
      if (value == null) {
        throw new NullPointerException();
      }
      checkByteStringIsUtf8(value);
      ensureExceptionPrincipalsIsMutable();
      exceptionPrincipals_.add(value);
      bitField0_ |= 0x00000002;
      onChanged();
      return this;
    }

    private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
        com.google.protobuf.LazyStringArrayList.emptyList();

    private void ensureDeniedPermissionsIsMutable() {
      if (!deniedPermissions_.isModifiable()) {
        deniedPermissions_ = new com.google.protobuf.LazyStringArrayList(deniedPermissions_);
      }
      bitField0_ |= 0x00000004;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @return A list containing the deniedPermissions.
     */
    public com.google.protobuf.ProtocolStringList getDeniedPermissionsList() {
      deniedPermissions_.makeImmutable();
      return deniedPermissions_;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @return The count of deniedPermissions.
     */
    public int getDeniedPermissionsCount() {
      return deniedPermissions_.size();
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param index The index of the element to return.
     * @return The deniedPermissions at the given index.
     */
    public java.lang.String getDeniedPermissions(int index) {
      return deniedPermissions_.get(index);
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param index The index of the value to return.
     * @return The bytes of the deniedPermissions at the given index.
     */
    public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
      return deniedPermissions_.getByteString(index);
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param index The index to set the value at.
     * @param value The deniedPermissions to set.
     * @return This builder for chaining.
     */
    public Builder setDeniedPermissions(int index, java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureDeniedPermissionsIsMutable();
      deniedPermissions_.set(index, value);
      bitField0_ |= 0x00000004;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param value The deniedPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addDeniedPermissions(java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureDeniedPermissionsIsMutable();
      deniedPermissions_.add(value);
      bitField0_ |= 0x00000004;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param values The deniedPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addAllDeniedPermissions(java.lang.Iterable<java.lang.String> values) {
      ensureDeniedPermissionsIsMutable();
      com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPermissions_);
      bitField0_ |= 0x00000004;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @return This builder for chaining.
     */
    public Builder clearDeniedPermissions() {
      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
      bitField0_ = (bitField0_ & ~0x00000004);
      ;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The permissions that are explicitly denied by this rule. Each permission
     * uses the format `{service_fqdn}/{resource}.{verb}`, where `{service_fqdn}`
     * is the fully qualified domain name for the service. For example,
     * `iam.googleapis.com/roles.list`.
     * </pre>
     *
     * <code>repeated string denied_permissions = 3;</code>
     *
     * @param value The bytes of the deniedPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addDeniedPermissionsBytes(com.google.protobuf.ByteString value) {
      if (value == null) {
        throw new NullPointerException();
      }
      checkByteStringIsUtf8(value);
      ensureDeniedPermissionsIsMutable();
      deniedPermissions_.add(value);
      bitField0_ |= 0x00000004;
      onChanged();
      return this;
    }

    private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
        com.google.protobuf.LazyStringArrayList.emptyList();

    private void ensureExceptionPermissionsIsMutable() {
      if (!exceptionPermissions_.isModifiable()) {
        exceptionPermissions_ = new com.google.protobuf.LazyStringArrayList(exceptionPermissions_);
      }
      bitField0_ |= 0x00000008;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @return A list containing the exceptionPermissions.
     */
    public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
      exceptionPermissions_.makeImmutable();
      return exceptionPermissions_;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @return The count of exceptionPermissions.
     */
    public int getExceptionPermissionsCount() {
      return exceptionPermissions_.size();
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param index The index of the element to return.
     * @return The exceptionPermissions at the given index.
     */
    public java.lang.String getExceptionPermissions(int index) {
      return exceptionPermissions_.get(index);
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param index The index of the value to return.
     * @return The bytes of the exceptionPermissions at the given index.
     */
    public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
      return exceptionPermissions_.getByteString(index);
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param index The index to set the value at.
     * @param value The exceptionPermissions to set.
     * @return This builder for chaining.
     */
    public Builder setExceptionPermissions(int index, java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureExceptionPermissionsIsMutable();
      exceptionPermissions_.set(index, value);
      bitField0_ |= 0x00000008;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param value The exceptionPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addExceptionPermissions(java.lang.String value) {
      if (value == null) {
        throw new NullPointerException();
      }
      ensureExceptionPermissionsIsMutable();
      exceptionPermissions_.add(value);
      bitField0_ |= 0x00000008;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param values The exceptionPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> values) {
      ensureExceptionPermissionsIsMutable();
      com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPermissions_);
      bitField0_ |= 0x00000008;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @return This builder for chaining.
     */
    public Builder clearExceptionPermissions() {
      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
      bitField0_ = (bitField0_ & ~0x00000008);
      ;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * Specifies the permissions that this rule excludes from the set of denied
     * permissions given by `denied_permissions`. If a permission appears in
     * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
     * denied.
     *
     * The excluded permissions can be specified using the same syntax as
     * `denied_permissions`.
     * </pre>
     *
     * <code>repeated string exception_permissions = 4;</code>
     *
     * @param value The bytes of the exceptionPermissions to add.
     * @return This builder for chaining.
     */
    public Builder addExceptionPermissionsBytes(com.google.protobuf.ByteString value) {
      if (value == null) {
        throw new NullPointerException();
      }
      checkByteStringIsUtf8(value);
      ensureExceptionPermissionsIsMutable();
      exceptionPermissions_.add(value);
      bitField0_ |= 0x00000008;
      onChanged();
      return this;
    }

    private com.google.type.Expr denialCondition_;
    private com.google.protobuf.SingleFieldBuilder<
            com.google.type.Expr, com.google.type.Expr.Builder, com.google.type.ExprOrBuilder>
        denialConditionBuilder_;

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     *
     * @return Whether the denialCondition field is set.
     */
    public boolean hasDenialCondition() {
      return ((bitField0_ & 0x00000010) != 0);
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     *
     * @return The denialCondition.
     */
    public com.google.type.Expr getDenialCondition() {
      if (denialConditionBuilder_ == null) {
        return denialCondition_ == null
            ? com.google.type.Expr.getDefaultInstance()
            : denialCondition_;
      } else {
        return denialConditionBuilder_.getMessage();
      }
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public Builder setDenialCondition(com.google.type.Expr value) {
      if (denialConditionBuilder_ == null) {
        if (value == null) {
          throw new NullPointerException();
        }
        denialCondition_ = value;
      } else {
        denialConditionBuilder_.setMessage(value);
      }
      bitField0_ |= 0x00000010;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public Builder setDenialCondition(com.google.type.Expr.Builder builderForValue) {
      if (denialConditionBuilder_ == null) {
        denialCondition_ = builderForValue.build();
      } else {
        denialConditionBuilder_.setMessage(builderForValue.build());
      }
      bitField0_ |= 0x00000010;
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public Builder mergeDenialCondition(com.google.type.Expr value) {
      if (denialConditionBuilder_ == null) {
        if (((bitField0_ & 0x00000010) != 0)
            && denialCondition_ != null
            && denialCondition_ != com.google.type.Expr.getDefaultInstance()) {
          getDenialConditionBuilder().mergeFrom(value);
        } else {
          denialCondition_ = value;
        }
      } else {
        denialConditionBuilder_.mergeFrom(value);
      }
      if (denialCondition_ != null) {
        bitField0_ |= 0x00000010;
        onChanged();
      }
      return this;
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public Builder clearDenialCondition() {
      bitField0_ = (bitField0_ & ~0x00000010);
      denialCondition_ = null;
      if (denialConditionBuilder_ != null) {
        denialConditionBuilder_.dispose();
        denialConditionBuilder_ = null;
      }
      onChanged();
      return this;
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public com.google.type.Expr.Builder getDenialConditionBuilder() {
      bitField0_ |= 0x00000010;
      onChanged();
      return internalGetDenialConditionFieldBuilder().getBuilder();
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    public com.google.type.ExprOrBuilder getDenialConditionOrBuilder() {
      if (denialConditionBuilder_ != null) {
        return denialConditionBuilder_.getMessageOrBuilder();
      } else {
        return denialCondition_ == null
            ? com.google.type.Expr.getDefaultInstance()
            : denialCondition_;
      }
    }

    /**
     *
     *
     * <pre>
     * The condition that determines whether this deny rule applies to a request.
     * If the condition expression evaluates to `true`, then the deny rule is
     * applied; otherwise, the deny rule is not applied.
     *
     * Each deny rule is evaluated independently. If this deny rule does not apply
     * to a request, other deny rules might still apply.
     *
     * The condition can use CEL functions that evaluate
     * [resource
     * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
     * functions and operators are not supported.
     * </pre>
     *
     * <code>.google.type.Expr denial_condition = 5;</code>
     */
    private com.google.protobuf.SingleFieldBuilder<
            com.google.type.Expr, com.google.type.Expr.Builder, com.google.type.ExprOrBuilder>
        internalGetDenialConditionFieldBuilder() {
      if (denialConditionBuilder_ == null) {
        denialConditionBuilder_ =
            new com.google.protobuf.SingleFieldBuilder<
                com.google.type.Expr, com.google.type.Expr.Builder, com.google.type.ExprOrBuilder>(
                getDenialCondition(), getParentForChildren(), isClean());
        denialCondition_ = null;
      }
      return denialConditionBuilder_;
    }

    // @@protoc_insertion_point(builder_scope:google.iam.v2.DenyRule)
  }

  // @@protoc_insertion_point(class_scope:google.iam.v2.DenyRule)
  private static final com.google.iam.v2.DenyRule DEFAULT_INSTANCE;

  static {
    DEFAULT_INSTANCE = new com.google.iam.v2.DenyRule();
  }

  public static com.google.iam.v2.DenyRule getDefaultInstance() {
    return DEFAULT_INSTANCE;
  }

  private static final com.google.protobuf.Parser<DenyRule> PARSER =
      new com.google.protobuf.AbstractParser<DenyRule>() {
        @java.lang.Override
        public DenyRule parsePartialFrom(
            com.google.protobuf.CodedInputStream input,
            com.google.protobuf.ExtensionRegistryLite extensionRegistry)
            throws com.google.protobuf.InvalidProtocolBufferException {
          Builder builder = newBuilder();
          try {
            builder.mergeFrom(input, extensionRegistry);
          } catch (com.google.protobuf.InvalidProtocolBufferException e) {
            throw e.setUnfinishedMessage(builder.buildPartial());
          } catch (com.google.protobuf.UninitializedMessageException e) {
            throw e.asInvalidProtocolBufferException().setUnfinishedMessage(builder.buildPartial());
          } catch (java.io.IOException e) {
            throw new com.google.protobuf.InvalidProtocolBufferException(e)
                .setUnfinishedMessage(builder.buildPartial());
          }
          return builder.buildPartial();
        }
      };

  public static com.google.protobuf.Parser<DenyRule> parser() {
    return PARSER;
  }

  @java.lang.Override
  public com.google.protobuf.Parser<DenyRule> getParserForType() {
    return PARSER;
  }

  @java.lang.Override
  public com.google.iam.v2.DenyRule getDefaultInstanceForType() {
    return DEFAULT_INSTANCE;
  }
}
