Google Cloud has introduced IAM Helper, a set of agent-facing building blocks that sit on top of its IAM engines, including Policy Intelligence and Privileged Access Manager. The Agent Skills are packaged as end-to-end workflows, helper scripts and guardrails using the open Agent Skills standard, and they work with Gemini CLI, Gemini Cloud Assist, ADK, Claude Code and Cursor.
Each skill separates read-only discovery from policy changes. In one example, a coding agent that hits a 403 PERMISSION_DENIED error uses iam-helper-for-troubleshooting to find a missing Pub/Sub permission. In another, iam-helper-for-policy-simulator tests proposed changes against 90 days of historical access logs before an update takes effect.
The skills draw on Google-managed MCP servers that expose atomic, read-only functions across Policy Troubleshooter, Policy Analyzer, Policy Simulator and the IAM v1 and v2 APIs. Teams can also call these tools directly from their own custom skills to connect IAM with internal ticketing and compliance checks. Privileged access requests go through Privileged Access Manager, which issues time-bound grants that are revoked when the task ends.
Why it matters if you build agents
Agents can now diagnose permission blockers, request scoped access and route policy changes to an administrator instead of stalling a build or falling back to broad grants. Pipelines should expect pauses for human approval on policy changes. Generated policies should also be checked against the risky configurations the policy management skill flags, including allUsers, roles/owner and roles/editor.
Get stories like this every weekday
One short email with the day's agent tooling news.