Powering agentic cloud governance: What's new in Organization Policy

Most cloud breaches still stem from preventable misconfigurations, despite rising zero-day threats. Organization Policy Service helps teams enforce security guardrails across Google Cloud hierarchies using over 100 predefined policies and custom constraints. Administrators can now use natural-language prompts with Gemini to author, refine, and test custom constraints without writing code. This reduces the need for deep expertise in Google Cloud resource schemas while maintaining granular control over configurations.

To streamline governance, Google Cloud is releasing the Organization Policy Model Context Protocol (MCP) server in general availability. The MCP server enables autonomous agents and pipelines to interact directly with Organization Policy, assisting with posture audits, drift detection, and exemption management. Tools like 'ListConstraints' and 'GetEffectivePolicy' allow agents to assess guardrails and verify compliance before changes are applied. Platform teams can also use conversational workflows to manage policies, reducing manual oversight.

Custom Organization Policy now supports natural-language authoring through Gemini, allowing administrators to define rules such as requiring agent-identity in Agent Runtime or preventing GKE auto-upgrade disables. Gemini can generate compliant and non-compliant test configurations to validate policies in dry-run mode before enforcement. A sample library of pre-authored constraints based on CIS and PCI standards is available to accelerate adoption.

Organization Policy provides proactive governance for Google Cloud resources, balancing speed and security for engineering teams. It supports core AI and compute services including Agent Runtime, Agent Search, Agent Studio, Cloud Run, and Google Kubernetes Engine. Enterprises can scale safely with built-in guardrails, autonomous tools, and tailored custom constraints across supported services.