Google Cloud launches IAM Helper for agent access tasks

Google Cloud has launched IAM Helper, a suite of agent-facing tools for identity and access management workflows aimed at organisations using autonomous agents in software development and cloud operations.

The product is designed to let software agents handle access management tasks that would otherwise require manual intervention from engineers or administrators. It acts as an orchestration layer for Google Cloud's existing identity and access management services, including Policy Intelligence and Privileged Access Manager.

Businesses are increasingly using autonomous agents to provision cloud resources, write infrastructure code and deploy services. But those systems can run into permission barriers in continuous integration and deployment pipelines. Google Cloud is positioning IAM Helper as a way to automate diagnosis of those problems and route higher-risk policy changes for human approval.

The tools are packaged using the open Agent Skills standard and work across several coding and assistant environments, including Gemini CLI, Gemini Cloud Assist, ADK, Claude Code and Cursor. The suite separates read-only diagnostics from policy changes: simulations run automatically, while access policy updates pause for human-in-the-loop confirmation based on customisable risk tiers.

Workflow tools

The launch includes several functions. One focuses on policy management, generating and validating IAM v1 allow bindings and IAM v2 deny rules in formats such as JSON, YAML and Terraform HCL, while blocking risky configurations such as public access settings or broad basic roles.

Another addresses permission errors by identifying missing permissions or blocking rules behind 403 errors. The troubleshooting workflow is intended to support both developers resolving issues themselves and administrators tracing inherited allow and deny rules across organisational structures.

A separate policy simulator is intended to help engineers assess the effect of proposed policy changes before they are applied. It tests changes against 90 days of historical access logs to check whether workloads or services would be disrupted.

The suite also includes a just-in-time privileged access workflow tied to Privileged Access Manager. That function is designed to support temporary production access for responders or maintenance agents, with approvals, audit records and automatic revocation built into the process.

Pipeline focus

Google Cloud set out two examples of how the tools could be used in practice. In one, a developer's coding agent encounters a 403 error during an application deployment, identifies a missing Pub/Sub permission and requests a one-hour just-in-time access grant instead of creating a support ticket.

In another, an infrastructure agent that hits a permission block during a routine deployment pipeline generates a revised least-privilege policy, checks it against historical logs and routes the change to an administrator for approval rather than letting the build fail outright.

The product is intended to reduce the amount of policy evaluation work performed by human administrators and large language models. Instead, IAM Helper sends orchestration tasks to Google Cloud's backend identity and access management services, which should reduce token usage and operational delays.

MCP layer

Underlying the higher-level skills is a set of Google-managed MCP tools connected to core IAM endpoints such as Policy Troubleshooter, Policy Analyser, Policy Simulator and IAM APIs. These are exposed as read-only atomic functions that agents can discover and invoke directly when developers need more customised workflows.

That means teams do not need to build their own wrappers for individual APIs when they want agents to perform tasks such as checking permissions, listing roles or traversing resource hierarchies. The design also allows customers to combine Google Cloud's IAM functions with internal ticketing systems, compliance checks and deployment pipelines.

The launch reflects a broader shift in cloud operations as companies try to give software agents more autonomy while preserving least-privilege controls. By placing simulations and diagnostics ahead of policy changes and requiring approval for higher-risk updates, Google Cloud is seeking to address a central challenge in agent-driven development: removing access bottlenecks without widening permissions.

Policy evaluation tasks such as hierarchy traversal, group expansion and rule analysis are handled on dedicated IAM endpoints spanning IAM v1 allow roles, IAM v2 deny, Policy Troubleshooter and Policy Analyser.