We are designing a one-time, operator-supervised setup using Secret Manager projects.secrets.addVersion and Cloud SQL Admin API v1 users.update for PostgreSQL.
After removing a principal’s write permissions, is there a documented, non-mutating API call that observes the target service’s actual authorization decision for that same principal and resource, specifically secretmanager.versions.add and cloudsql.users.update?
We distinguish policy analysis from service-side enforcement. Secret Manager’s testIamPermissions documentation says it is not intended for authorization checking; IAM propagation timings alone also do not establish that a particular service now rejects a write. We do not want to submit invalid write payloads and assume authorization is checked first.
If a supported check exists, please link its API contract and explain what its result establishes, including propagation/cache limitations and already-issued access tokens. If no such non-mutating check is documented, that boundary is useful to know too. We are asking about supported API semantics, not requesting access to any project.
References: