Scale agents securely with IAM Helper Agent Skills and MCP Tools

Google Cloud has launched IAM Helper, a suite of intelligent building blocks designed to automate end-to-end Identity and Access Management (IAM) workflows for autonomous agents. The tool acts as an agent-native orchestration layer for Google Cloud IAM, integrating with existing engines like Policy Intelligence and Privileged Access Manager (PAM) to enable agents to handle access management dynamically. By offloading policy evaluation to Google Cloud’s backend, it reduces administrative overhead and accelerates deployment while maintaining least-privilege security standards.

IAM Helper Agent Skills are packaged using the open Agent Skills standard and guide agents through the cloud access lifecycle, including diagnostics, simulations, and policy changes. These skills work across common agents such as Gemini CLI, Gemini Cloud Assist, ADK, Claude Code, and Cursor. Each skill separates read-only discovery from policy modifications, ensuring human-in-the-loop confirmation for changes based on customizable risk tiers, thereby mitigating risks of over-permissioning.

The suite includes tools like iam-helper-for-troubleshooting, which identifies missing permissions in seconds, and iam-helper-for-privileged-access-management, which requests just-in-time (JIT) grants to resolve 403 errors. Another tool, iam-helper-for-policy-simulator, verifies proposed policy changes against 90 days of historical access logs to prevent disruptions. These tools are designed for token and cost efficiency, enabling agents to execute multi-step administrative operations autonomously while maintaining compliance.

IAM Helper is built on a foundation of Google Cloud IAM Helper MCP tools, which provide atomic, read-only functions via Google-managed MCP servers across core IAM endpoints. These tools allow agents to query the cloud backend directly, avoiding the need for custom API wrappers and reducing token usage. Teams can use these tools to integrate Google Cloud IAM capabilities with internal systems, custom compliance checks, and deployment pipelines, accelerating agentic workflows and reducing operational overhead.