Scenario: Allow access to the NAT gateway only through OpenAPI (programmatic access), not through the console.
Policy example:

{ 
    "Statement": [ 
        { 
            "Effect": "Allow", 
            "Action": [ 
                "natgateway:*" 
            ], 
            "Resource": [ 
                "*" 
            ], 
            "Condition": { 
                "Bool": { 
                    "volc:ViaConsole": [ 
                        "false" 
                    ] 
                } 
            } 
        } 
    ] 
}

For details of the condition key, please refer to the Condition Use Instructions