# Google Cloud launches IAM Helper Agent Skills and MCP tools for agent access management

published: 2026-10-26T17:05:34.684Z
topic: identity
source: https://cloud.google.com/blog/products/identity-security/scale-agents-securely-with-iam-helper-agent-skills-and-mcp-tools/
url: https://aiagentnews.io/stories/google-cloud-launches-iam-helper-agent-skills-and-mcp-tools-for-agent-access

Google Cloud has introduced IAM Helper, a set of Agent Skills and MCP tools that let coding agents, deployment pipelines and custom agents handle Identity and Access Management tasks. Diagnostics and simulations run automatically, while any change to access policies waits for human confirmation under customizable risk tiers.

Google Cloud has introduced IAM Helper, a set of agent-facing building blocks that sit on top of its IAM engines, including Policy Intelligence and Privileged Access Manager. The Agent Skills are packaged as end-to-end workflows, helper scripts and guardrails using the open Agent Skills standard, and they work with Gemini CLI, Gemini Cloud Assist, ADK, Claude Code and Cursor.

Each skill separates read-only discovery from policy changes. In one example, a coding agent that hits a 403 PERMISSION_DENIED error uses iam-helper-for-troubleshooting to find a missing Pub/Sub permission. In another, iam-helper-for-policy-simulator tests proposed changes against 90 days of historical access logs before an update takes effect.

The skills draw on Google-managed MCP servers that expose atomic, read-only functions across Policy Troubleshooter, Policy Analyzer, Policy Simulator and the IAM v1 and v2 APIs. Teams can also call these tools directly from their own custom skills to connect IAM with internal ticketing and compliance checks. Privileged access requests go through Privileged Access Manager, which issues time-bound grants that are revoked when the task ends.

## Why it matters if you build agents

Agents can now diagnose permission blockers, request scoped access and route policy changes to an administrator instead of stalling a build or falling back to broad grants. Pipelines should expect pauses for human approval on policy changes. Generated policies should also be checked against the risky configurations the policy management skill flags, including allUsers, roles/owner and roles/editor.