chore: Update discovery artifacts

docs/dyn/accesscontextmanager_v1.organizations.gcpUserAccessBindings.html

@@ -119,7 +119,11 @@ <h3>Method Details</h3>
   ],
   &quot;groupKey&quot;: &quot;A String&quot;, # Optional. Immutable. Google Group id whose users are subject to this binding&#x27;s restrictions. See &quot;id&quot; in the [Google Workspace Directory API&#x27;s Group Resource] (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource). If a group&#x27;s email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: &quot;01d520gv4vjcrht&quot;
   &quot;name&quot;: &quot;A String&quot;, # Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: &quot;organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N&quot;
-  &quot;restrictedClientApplications&quot;: [ # Optional. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
+  &quot;principal&quot;: { # The comprehensive identity container supporting identities including groups, service accounts and federated identities. Only one of them can be set to create an access binding. # Optional. Immutable. The principal that is subject to the access policies in this policy binding.
+    &quot;serviceAccount&quot;: &quot;A String&quot;, # Immutable. Service account email used to assign policies to a specific service account. If a service account is subject to multiple policies (e.g., if there is a policy for all service accounts in a project and a policy for the service account), the closest (i.e. the most specific) dry-run policy will be used for the dry-run functionality and the closest policy will be used for the enforcement.
+    &quot;serviceAccountProjectNumber&quot;: &quot;A String&quot;, # Immutable. Cloud project number used to assign policies to all service accounts owned by the project.
+  },
+  &quot;restrictedClientApplications&quot;: [ # Optional. Deprecated: use scoped_access_settings instead. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
     { # An application that accesses Google Cloud APIs.
       &quot;clientId&quot;: &quot;A String&quot;, # The OAuth client ID of the application.
       &quot;name&quot;: &quot;A String&quot;, # The name of the application. Example: &quot;Cloud Console&quot;
@@ -257,7 +261,11 @@ <h3>Method Details</h3>
   ],
   &quot;groupKey&quot;: &quot;A String&quot;, # Optional. Immutable. Google Group id whose users are subject to this binding&#x27;s restrictions. See &quot;id&quot; in the [Google Workspace Directory API&#x27;s Group Resource] (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource). If a group&#x27;s email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: &quot;01d520gv4vjcrht&quot;
   &quot;name&quot;: &quot;A String&quot;, # Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: &quot;organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N&quot;
-  &quot;restrictedClientApplications&quot;: [ # Optional. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
+  &quot;principal&quot;: { # The comprehensive identity container supporting identities including groups, service accounts and federated identities. Only one of them can be set to create an access binding. # Optional. Immutable. The principal that is subject to the access policies in this policy binding.
+    &quot;serviceAccount&quot;: &quot;A String&quot;, # Immutable. Service account email used to assign policies to a specific service account. If a service account is subject to multiple policies (e.g., if there is a policy for all service accounts in a project and a policy for the service account), the closest (i.e. the most specific) dry-run policy will be used for the dry-run functionality and the closest policy will be used for the enforcement.
+    &quot;serviceAccountProjectNumber&quot;: &quot;A String&quot;, # Immutable. Cloud project number used to assign policies to all service accounts owned by the project.
+  },
+  &quot;restrictedClientApplications&quot;: [ # Optional. Deprecated: use scoped_access_settings instead. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
     { # An application that accesses Google Cloud APIs.
       &quot;clientId&quot;: &quot;A String&quot;, # The OAuth client ID of the application.
       &quot;name&quot;: &quot;A String&quot;, # The name of the application. Example: &quot;Cloud Console&quot;
@@ -336,7 +344,11 @@ <h3>Method Details</h3>
       ],
       &quot;groupKey&quot;: &quot;A String&quot;, # Optional. Immutable. Google Group id whose users are subject to this binding&#x27;s restrictions. See &quot;id&quot; in the [Google Workspace Directory API&#x27;s Group Resource] (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource). If a group&#x27;s email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: &quot;01d520gv4vjcrht&quot;
       &quot;name&quot;: &quot;A String&quot;, # Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: &quot;organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N&quot;
-      &quot;restrictedClientApplications&quot;: [ # Optional. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
+      &quot;principal&quot;: { # The comprehensive identity container supporting identities including groups, service accounts and federated identities. Only one of them can be set to create an access binding. # Optional. Immutable. The principal that is subject to the access policies in this policy binding.
+        &quot;serviceAccount&quot;: &quot;A String&quot;, # Immutable. Service account email used to assign policies to a specific service account. If a service account is subject to multiple policies (e.g., if there is a policy for all service accounts in a project and a policy for the service account), the closest (i.e. the most specific) dry-run policy will be used for the dry-run functionality and the closest policy will be used for the enforcement.
+        &quot;serviceAccountProjectNumber&quot;: &quot;A String&quot;, # Immutable. Cloud project number used to assign policies to all service accounts owned by the project.
+      },
+      &quot;restrictedClientApplications&quot;: [ # Optional. Deprecated: use scoped_access_settings instead. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
         { # An application that accesses Google Cloud APIs.
           &quot;clientId&quot;: &quot;A String&quot;, # The OAuth client ID of the application.
           &quot;name&quot;: &quot;A String&quot;, # The name of the application. Example: &quot;Cloud Console&quot;
@@ -423,7 +435,11 @@ <h3>Method Details</h3>
   ],
   &quot;groupKey&quot;: &quot;A String&quot;, # Optional. Immutable. Google Group id whose users are subject to this binding&#x27;s restrictions. See &quot;id&quot; in the [Google Workspace Directory API&#x27;s Group Resource] (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource). If a group&#x27;s email address/alias is changed, this resource will continue to point at the changed group. This field does not accept group email addresses or aliases. Example: &quot;01d520gv4vjcrht&quot;
   &quot;name&quot;: &quot;A String&quot;, # Immutable. Assigned by the server during creation. The last segment has an arbitrary length and has only URI unreserved characters (as defined by [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)). Should not be specified by the client during creation. Example: &quot;organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N&quot;
-  &quot;restrictedClientApplications&quot;: [ # Optional. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
+  &quot;principal&quot;: { # The comprehensive identity container supporting identities including groups, service accounts and federated identities. Only one of them can be set to create an access binding. # Optional. Immutable. The principal that is subject to the access policies in this policy binding.
+    &quot;serviceAccount&quot;: &quot;A String&quot;, # Immutable. Service account email used to assign policies to a specific service account. If a service account is subject to multiple policies (e.g., if there is a policy for all service accounts in a project and a policy for the service account), the closest (i.e. the most specific) dry-run policy will be used for the dry-run functionality and the closest policy will be used for the enforcement.
+    &quot;serviceAccountProjectNumber&quot;: &quot;A String&quot;, # Immutable. Cloud project number used to assign policies to all service accounts owned by the project.
+  },
+  &quot;restrictedClientApplications&quot;: [ # Optional. Deprecated: use scoped_access_settings instead. A list of applications that are subject to this binding&#x27;s restrictions. If the list is empty, the binding restrictions will universally apply to all applications.
     { # An application that accesses Google Cloud APIs.
       &quot;clientId&quot;: &quot;A String&quot;, # The OAuth client ID of the application.
       &quot;name&quot;: &quot;A String&quot;, # The name of the application. Example: &quot;Cloud Console&quot;