IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

For changes that occurred before 2022, see Archived permissions change log.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

IAM changes for the week of 2026-08-11

Service	Description
App Hub	The following permissions have been added to the App Management Viewer role (`roles/apphub.appManagementViewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Batch	The following permissions have been added to the Google Batch Service Agent role (`roles/batch.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Cloud TPU	The following permissions have been added to the Cloud TPU V2 API Service Agent role (`roles/cloudtpu.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Managed Service for Apache Airflow	The following permissions have been added to the Cloud Composer API Service Agent role (`roles/composer.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Compute Engine	The following permissions have been added to the Compute Instance Admin (beta) role (`roles/compute.instanceAdmin`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Compute Engine	The following permissions have been added to the Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Service Agent role (`roles/container.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Dataflow	The following permissions have been added to the Cloud Dataflow Service Agent role (`roles/dataflow.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Knowledge Catalog	The following permissions have been added to the Dataplex Catalog Admin role (`roles/dataplex.catalogAdmin`): `dataplex.locations.get` `dataplex.locations.list`
Managed Service for Apache Spark	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Application Design Center	The following permissions have been added to the Application Design Center Admin role (`roles/designcenter.admin`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Admin role (`roles/designcenter.applicationAdmin`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Editor role (`roles/designcenter.applicationEditor`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Viewer role (`roles/designcenter.applicationViewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Designcenter Editor role (`roles/designcenter.editor`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Design Center User role (`roles/designcenter.user`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Application Design Center	The following permissions have been added to the Application Design Center Viewer role (`roles/designcenter.viewer`): `auditmanager.auditReports.get` `auditmanager.auditReports.list` `auditmanager.auditSchedules.get` `auditmanager.auditSchedules.list` `auditmanager.billingSettings.get` `auditmanager.controlReports.get` `auditmanager.controlReports.list` `auditmanager.controls.list` `auditmanager.findings.list` `auditmanager.locations.get` `auditmanager.locations.list` `auditmanager.operations.get` `auditmanager.operations.list` `auditmanager.resourceEnrollmentStatuses.get` `auditmanager.resourceEnrollmentStatuses.list` `cloudsecuritycompliance.auditReports.get` `cloudsecuritycompliance.auditReports.list` `cloudsecuritycompliance.billingSettings.get` `cloudsecuritycompliance.cloudControlDeployments.get` `cloudsecuritycompliance.cloudControlDeployments.list` `cloudsecuritycompliance.cloudControlPredictions.get` `cloudsecuritycompliance.cloudControlPredictions.list` `cloudsecuritycompliance.cloudControls.get` `cloudsecuritycompliance.cloudControls.list` `cloudsecuritycompliance.cmEnrollments.get` `cloudsecuritycompliance.controlComplianceSummaries.list` `cloudsecuritycompliance.controlReports.get` `cloudsecuritycompliance.controls.get` `cloudsecuritycompliance.controls.list` `cloudsecuritycompliance.findingSummaries.list` `cloudsecuritycompliance.findings.list` `cloudsecuritycompliance.frameworkAudits.get` `cloudsecuritycompliance.frameworkAudits.list` `cloudsecuritycompliance.frameworkComplianceReports.aggregate` `cloudsecuritycompliance.frameworkComplianceReports.get` `cloudsecuritycompliance.frameworkComplianceSummaries.list` `cloudsecuritycompliance.frameworkDeployments.get` `cloudsecuritycompliance.frameworkDeployments.list` `cloudsecuritycompliance.frameworks.get` `cloudsecuritycompliance.frameworks.list` `cloudsecuritycompliance.locations.get` `cloudsecuritycompliance.locations.list` `cloudsecuritycompliance.operations.get` `cloudsecuritycompliance.operations.list` `cloudsecuritycompliance.resourceEnrollmentStatuses.get` `cloudsecuritycompliance.resourceEnrollmentStatuses.list`
Developer Connect	The Developer Connect Admin role (`roles/developerconnect.admin`) has reached General Availability (GA).
Developer Connect	The Developer Connect Git Proxy Reader role (`roles/developerconnect.gitProxyReader`) has reached General Availability (GA).
Developer Connect	The Developer Connect Git Proxy User role (`roles/developerconnect.gitProxyUser`) has reached General Availability (GA).
Developer Connect	The Developer Connect User role (`roles/developerconnect.user`) has reached General Availability (GA).
Developer Connect	The Developer Connect Viewer role (`roles/developerconnect.viewer`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.agents.get` `aiplatform.agents.list`
Flow	The Flow Service Agent role (`roles/flow.serviceAgent`) has reached General Availability (GA).
Cloud Life Sciences	The following permissions have been added to the Genomics Service Agent role (`roles/genomics.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Identity and Access Management	The following permissions have been added to the Site Reliability Engineer role (`roles/iam.siteReliabilityEngineer`): `compute.reservationSlots.update`
Cloud Life Sciences	The following permissions have been added to the Cloud Life Sciences Service Agent role (`roles/lifesciences.serviceAgent`): `compute.reservationSlots.get` `compute.reservationSlots.list` `compute.reservationSlots.update`
Notebooks	The following permissions have been added to the AI Platform Notebooks Service Agent role (`roles/notebooks.serviceAgent`): `compute.reservationSlots.update`
Developer Connect	The following permissions have reached General Availability (GA): `developerconnect.accountConnectors.create` `developerconnect.accountConnectors.delete` `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.get` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.list` `developerconnect.accountConnectors.update` `developerconnect.connections.constructGitHubAppManifest` `developerconnect.connections.create` `developerconnect.connections.delete` `developerconnect.connections.fetchGitHubInstallations` `developerconnect.connections.fetchLinkableGitRepositories` `developerconnect.connections.generateGitHubStateToken` `developerconnect.connections.get` `developerconnect.connections.list` `developerconnect.connections.processGitHubAppCreationCallback` `developerconnect.connections.processGitHubOAuthCallback` `developerconnect.connections.update` `developerconnect.gitRepositoryLinks.create` `developerconnect.gitRepositoryLinks.delete` `developerconnect.gitRepositoryLinks.fetchGitRefs` `developerconnect.gitRepositoryLinks.fetchReadToken` `developerconnect.gitRepositoryLinks.fetchReadWriteToken` `developerconnect.gitRepositoryLinks.get` `developerconnect.gitRepositoryLinks.gitProxyRead` `developerconnect.gitRepositoryLinks.gitProxyWrite` `developerconnect.gitRepositoryLinks.list` `developerconnect.locations.get` `developerconnect.locations.list` `developerconnect.operations.cancel` `developerconnect.operations.delete` `developerconnect.operations.get` `developerconnect.operations.list` `developerconnect.providers.list` `developerconnect.users.delete` `developerconnect.users.deleteSelf` `developerconnect.users.fetchAccessToken` `developerconnect.users.finishOAuth` `developerconnect.users.getSelf` `developerconnect.users.list` `developerconnect.users.startOAuth`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.schemas.migrate`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.schemas.migrate`
Production Actuation Service	The following permissions have been added: `prodactuation.dnsConfigs.create` `prodactuation.dnsConfigs.delete` `prodactuation.dnsConfigs.get` `prodactuation.dnsConfigs.list` `prodactuation.dnsConfigs.update` `prodactuation.ganpatiGroups.create` `prodactuation.ganpatiGroups.createMembership` `prodactuation.ganpatiGroups.delete` `prodactuation.ganpatiGroups.get` `prodactuation.ganpatiGroups.list` `prodactuation.ganpatiGroups.listMemberships` `prodactuation.ganpatiGroups.update` `prodactuation.ganpatiMemberships.delete` `prodactuation.ganpatiMemberships.get` `prodactuation.ganpatiMemberships.update` `prodactuation.locations.get` `prodactuation.locations.list` `prodactuation.operations.cancel` `prodactuation.operations.delete` `prodactuation.operations.get` `prodactuation.operations.list`
Production Actuation Service	The following permissions are supported in custom roles: `prodactuation.dnsConfigs.create` `prodactuation.dnsConfigs.delete` `prodactuation.dnsConfigs.get` `prodactuation.dnsConfigs.list` `prodactuation.dnsConfigs.update` `prodactuation.ganpatiGroups.create` `prodactuation.ganpatiGroups.createMembership` `prodactuation.ganpatiGroups.delete` `prodactuation.ganpatiGroups.get` `prodactuation.ganpatiGroups.list` `prodactuation.ganpatiGroups.listMemberships` `prodactuation.ganpatiGroups.update` `prodactuation.ganpatiMemberships.delete` `prodactuation.ganpatiMemberships.get` `prodactuation.ganpatiMemberships.update` `prodactuation.locations.get` `prodactuation.locations.list` `prodactuation.operations.cancel` `prodactuation.operations.delete` `prodactuation.operations.get` `prodactuation.operations.list`

IAM changes for the week of 2026-08-04

Service	Description
Agent Identity API	The Agent Identity Admin role (`roles/agentidentity.admin`) has reached General Availability (GA).
Agent Identity API	The Agent Identity Editor role (`roles/agentidentity.editor`) has reached General Availability (GA).
Agent Identity API	The Agent Identity User role (`roles/agentidentity.user`) has reached General Availability (GA).
Agent Identity API	The Agent Identity Viewer role (`roles/agentidentity.viewer`) has reached General Availability (GA).
Gemini Enterprise Agent Platform	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `agentregistry.operations.cancel` `agentregistry.operations.delete` `agentregistry.operations.get` `agentregistry.operations.list` `agentregistry.skills.create` `agentregistry.skills.delete`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Service Agent role (`roles/backupdr.serviceAgent`): `file.operations.get`
BigQuery	The following permissions have been added to the BigQuery Studio Admin role (`roles/bigquery.studioAdmin`): `geminidataanalytics.dataAgents.create` `geminidataanalytics.locations.chat` `geminidataanalytics.operations.get`
BigQuery	The following permissions have been added to the BigQuery Studio User role (`roles/bigquery.studioUser`): `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.locations.chat`
Data Lineage API	The following permissions have been added to the Data Lineage Editor role (`roles/datalineage.editor`): `datalineage.processes.delete` `datalineage.runs.delete`
Database Migration Service	The following permissions have been added to the Database Migration Admin role (`roles/datamigration.admin`): `compute.networkAttachments.use`
Database Migration Service	The following permissions have been added to the Datamigration Editor role (`roles/datamigration.editor`): `compute.networkAttachments.use`
Datastream	The following permissions have been added to the Datastream Admin role (`roles/datastream.admin`): `compute.networkAttachments.use`
Distributed Cloud Edge Container	The following permissions have been added to the Edge Container Service Agent role (`roles/edgecontainer.serviceAgent`): `gke.fleets.create` `gke.fleets.delete` `gke.fleets.get` `gkehub.endpoints.connect` `gkehub.features.list` `gkehub.fleet.create` `gkehub.fleet.delete` `gkehub.fleet.get` `gkehub.locations.get` `gkehub.locations.list` `gkehub.operations.delete` `gkehub.operations.list`
Cluster Director	The following permissions have been added to the Cluster Director Service Agent role (`roles/hypercomputecluster.serviceAgent`): `hypercomputecluster.locations.get`
Identity and Access Management	The following permissions have been added to the Data Scientist role (`roles/iam.dataScientist`): `geminidataanalytics.dataAgents.get` `geminidataanalytics.dataAgents.list` `geminidataanalytics.locations.chat`
Agent Identity API	The following permissions have reached General Availability (GA): `agentidentity.accessSummaries.get` `agentidentity.accessSummaries.list` `agentidentity.authProviders.create` `agentidentity.authProviders.delete` `agentidentity.authProviders.get` `agentidentity.authProviders.getIamPolicy` `agentidentity.authProviders.list` `agentidentity.authProviders.queryWorkloads` `agentidentity.authProviders.retrieveCredentials` `agentidentity.authProviders.revokeAuthorizations` `agentidentity.authProviders.setIamPolicy` `agentidentity.authProviders.undelete` `agentidentity.authProviders.update` `agentidentity.authorizations.delete` `agentidentity.authorizations.get` `agentidentity.authorizations.list` `agentidentity.locations.get` `agentidentity.locations.list`
Agent Registry	The following permissions have been added: `agentregistry.publishers.get` `agentregistry.publishers.list` `agentregistry.skillRevisions.create` `agentregistry.skillRevisions.delete` `agentregistry.skillRevisions.get` `agentregistry.skillRevisions.list` `agentregistry.skills.create` `agentregistry.skills.delete` `agentregistry.skills.get` `agentregistry.skills.list` `agentregistry.skills.search` `agentregistry.skills.update`
Agent Registry	The following permissions are supported in custom roles: `agentregistry.publishers.get` `agentregistry.publishers.list` `agentregistry.skillRevisions.create` `agentregistry.skillRevisions.delete` `agentregistry.skillRevisions.get` `agentregistry.skillRevisions.list` `agentregistry.skills.create` `agentregistry.skills.delete` `agentregistry.skills.get` `agentregistry.skills.list` `agentregistry.skills.search` `agentregistry.skills.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.importJobs.delete` `cloudkms.keyRings.delete`
Discovery Engine	The following permissions have been added: `discoveryengine.collections.getIamPolicy` `discoveryengine.collections.setIamPolicy` `discoveryengine.dataStores.getIamPolicy` `discoveryengine.dataStores.setIamPolicy` `discoveryengine.projectOverageConfigs.get`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.collections.getIamPolicy` `discoveryengine.collections.setIamPolicy` `discoveryengine.dataStores.getIamPolicy` `discoveryengine.dataStores.setIamPolicy` `discoveryengine.projectOverageConfigs.get`
Firebase App Check	The following permissions have been added: `firebaseappcheck.tokens.mint`
Firebase App Check	The following permissions are supported in custom roles: `firebaseappcheck.tokens.mint`
Firebase App Check	The following permissions have reached General Availability (GA): `firebaseappcheck.tokens.mint`
Firebase Data Connect	The following permissions have been added: `firebasedataconnect.services.generateQuery` `firebasedataconnect.services.generateSchema`
Firebase Data Connect	The following permissions are supported in custom roles: `firebasedataconnect.services.generateQuery` `firebasedataconnect.services.generateSchema`

IAM changes for the week of 2026-07-28

Service	Description
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Admin role (`roles/container.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Google Kubernetes Engine	The following permissions have been added to the Kubernetes Engine Cluster Admin role (`roles/container.clusterAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Data Fusion	The following permissions have been removed from the Cloud Data Fusion API Service Agent role (`roles/datafusion.serviceAgent`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been removed from the Data Scientist role (`roles/iam.dataScientist`): `dataplex.locations.get` `dataplex.locations.list`
AI Platform	The AI Platform Editor role (`roles/ml.editor`) has reached General Availability (GA).
Spanner	The following permissions have been removed from the Cloud Spanner Database Reader role (`roles/spanner.databaseReader`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database Reader with DataBoost role (`roles/spanner.databaseReaderWithDataBoost`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database User role (`roles/spanner.databaseUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Spanner	The following permissions have been removed from the Cloud Spanner Database Graph Intelligence features user role (`roles/spanner.graphIntelligenceUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.get` `dataplex.operations.list`
Cloud TPU	The TPU Editor role (`roles/tpu.editor`) has reached General Availability (GA).
VM Migration	The following permissions have been added to the VM Migration Administrator role (`roles/vmmigration.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cloud Billing	The following permissions have been added: `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Cloud Billing	The following permissions are supported in custom roles: `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Cloud Billing	The following permissions have reached General Availability (GA): `billing.budgets.configureSpendCap` `billing.resourcebudgets.configureSpendCap`
Google Security Operations	The following permissions have been added: `chronicle.queryMetrics.get` `chronicle.queryMetrics.list`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.queryMetrics.get` `chronicle.queryMetrics.list`
Cloud SQL	The following permissions have been added: `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Cloud SQL	The following permissions are supported in custom roles: `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Cloud SQL	The following permissions have reached General Availability (GA): `cloudsql.instances.cancelAgentSession` `cloudsql.instances.createTestingAgentSession` `cloudsql.instances.getAgentSession` `cloudsql.instances.listAgentSessions`
Compute Engine	The following permissions have been added: `compute.globalFrontendSettings.get` `compute.globalFrontendSettings.update`
Compute Engine	The following permissions are supported in custom roles: `compute.globalFrontendSettings.get` `compute.globalFrontendSettings.update`

IAM changes for the week of 2026-07-21

Service	Description
Flow	The FlowService Service Agent role (`roles/aisandbox.serviceAgent`) has reached General Availability (GA).
AlloyDB for PostgreSQL	The following permissions have been removed from the AlloyDB Admin role (`roles/alloydb.admin`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
AlloyDB for PostgreSQL	The following permissions have been removed from the AlloyDB Database User role (`roles/alloydb.databaseUser`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete` `dataplex.operations.get` `dataplex.operations.list`
Backup and Disaster Recovery	The following permissions have been added to the Backup and DR Admin role (`roles/backupdr.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Business AI Code	The Business AI Code Service Agent role (`roles/businessaicode.serviceAgent`) has reached General Availability (GA).
Business AI Code	The User role for Business AI Code API role (`roles/businessaicode.user`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyFederatedCases.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.propertySchemaDefinitions.get` `chronicle.views.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.legacyCaseFederationPlatforms.get` `chronicle.legacyFederatedCases.get` `chronicle.legacySystemMetadata.placeholders` `chronicle.propertySchemaDefinitions.get` `chronicle.views.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Admin role (`roles/cloudtasks.admin`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Editor role (`roles/cloudtasks.editor`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Enqueuer role (`roles/cloudtasks.enqueuer`): `cloudtasks.operations.get`
Cloud Tasks	The following permissions have been added to the Cloud Tasks Viewer role (`roles/cloudtasks.viewer`): `cloudtasks.operations.get`
Customer Experience Insights	The following permissions have been added to the Contact Center AI Insights Service Agent role (`roles/contactcenterinsights.serviceAgent`): `ces.agents.get` `ces.agents.list` `ces.appVersions.get` `ces.appVersions.list` `ces.apps.get` `ces.apps.list` `ces.changelogs.get` `ces.changelogs.list` `ces.deployments.get` `ces.deployments.list` `ces.examples.get` `ces.examples.list` `ces.guardrails.get` `ces.guardrails.list` `ces.tools.get` `ces.tools.list` `ces.toolsets.get` `ces.toolsets.list`
Sensitive Data Protection	The following permissions have been removed from the DLP Organization Data Profiles Driver role (`roles/dlp.orgdriver`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Sensitive Data Protection	The following permissions have been removed from the DLP Project Data Profiles Driver role (`roles/dlp.projectdriver`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Basic Role	The following permissions have been added to the Editor role (`roles/editor`): `cloudtasks.operations.get`
Identity and Access Management	The following permissions have been removed from the Databases Admin role (`roles/iam.databasesAdmin`): `dataplex.locations.get` `dataplex.locations.list` `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been removed from the Data Scientist role (`roles/iam.dataScientist`): `dataplex.operations.cancel` `dataplex.operations.delete`
Identity and Access Management	The following permissions have been added to the Support User role (`roles/iam.supportUser`): `cloudtasks.operations.get`
Basic Role	The following permissions have been added to the Owner role (`roles/owner`): `cloudtasks.operations.get`
Basic Role	The following permissions have been added to the Viewer role (`roles/viewer`): `cloudtasks.operations.get`
Cloud Workstations	The following permissions have been added to the Cloud Workstations Admin role (`roles/workstations.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
BigLake	The following permissions have reached General Availability (GA): `biglake.tables.register`
BigQuery	The following permissions have been added: `bigquery.reservationGroups.update`
BigQuery	The following permissions are supported in custom roles: `bigquery.reservationGroups.update`
BigQuery	The following permissions have reached General Availability (GA): `bigquery.jobs.createGlobalQuery` `bigquery.reservationGroups.create` `bigquery.reservationGroups.delete` `bigquery.reservationGroups.get` `bigquery.reservationGroups.list`
BigQuery Reservation API	The following permissions have been added: `bigqueryreservation.googleapis.com/reservationGroups.update`
BigQuery Reservation API	The following permissions are supported in custom roles: `bigqueryreservation.googleapis.com/reservationGroups.update`
BigQuery Reservation API	The following permissions have reached General Availability (GA): `bigqueryreservation.googleapis.com/reservationGroups.create` `bigqueryreservation.googleapis.com/reservationGroups.delete` `bigqueryreservation.googleapis.com/reservationGroups.get` `bigqueryreservation.googleapis.com/reservationGroups.list`
Bigtable	The following permissions are supported in custom roles: `bigtable.materializedViews.create` `bigtable.materializedViews.delete` `bigtable.materializedViews.get` `bigtable.materializedViews.getIamPolicy` `bigtable.materializedViews.list` `bigtable.materializedViews.readRows` `bigtable.materializedViews.sampleRowKeys` `bigtable.materializedViews.setIamPolicy` `bigtable.materializedViews.update`
Business AI Code	The following permissions have been added: `businessaicode.locations.fetchQuotaStatus`
Business AI Code	The following permissions are supported in custom roles: `businessaicode.locations.fetchQuotaStatus`
Business AI Code	The following permissions have reached General Availability (GA): `businessaicode.locations.fetchQuotaStatus` `businessaicode.locations.generateContent` `businessaicode.locations.queryConfiguration` `businessaicode.locations.selfAssignLicense` `businessaicode.locations.sendTelemetry`
Cloud Tasks	The following permissions have been added: `cloudtasks.operations.get`
Developer Connect	The following permissions have been added: `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.httpProxyRead` `developerconnect.accountConnectors.httpProxyWrite`
Developer Connect	The following permissions are supported in custom roles: `developerconnect.accountConnectors.fetchUserRepositories` `developerconnect.accountConnectors.gitProxyRead` `developerconnect.accountConnectors.gitProxyWrite` `developerconnect.accountConnectors.httpProxyRead` `developerconnect.accountConnectors.httpProxyWrite`
Looker	The following permissions have been added: `looker.instances.createTagBinding` `looker.instances.deleteTagBinding` `looker.instances.listEffectiveTags` `looker.instances.listTagBindings`
Looker	The following permissions have reached General Availability (GA): `looker.instances.createTagBinding` `looker.instances.deleteTagBinding` `looker.instances.listEffectiveTags` `looker.instances.listTagBindings`
Google Cloud MCP servers	The following permissions are supported in custom roles: `mcp.tools.call`
Model Armor	The following permissions have been added: `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Model Armor	The following permissions are supported in custom roles: `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Model Armor	The following permissions have reached General Availability (GA): `modelarmor.topics.create` `modelarmor.topics.delete` `modelarmor.topics.get` `modelarmor.topics.list` `modelarmor.topics.test` `modelarmor.topics.update`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.ontap.get`
Google Cloud NetApp Volumes	The following permissions are supported in custom roles: `netapp.ontap.get`
Network Security	The following permissions have been added: `networksecurity.authorizationPolicies.createTagBinding` `networksecurity.authorizationPolicies.deleteTagBinding` `networksecurity.authorizationPolicies.listEffectiveTags` `networksecurity.authorizationPolicies.listTagBindings` `networksecurity.clientTlsPolicies.createTagBinding` `networksecurity.clientTlsPolicies.deleteTagBinding` `networksecurity.clientTlsPolicies.listEffectiveTags` `networksecurity.clientTlsPolicies.listTagBindings` `networksecurity.serverTlsPolicies.createTagBinding` `networksecurity.serverTlsPolicies.deleteTagBinding` `networksecurity.serverTlsPolicies.listEffectiveTags` `networksecurity.serverTlsPolicies.listTagBindings`
Secret Manager	The following permissions have been added: `secretmanager.secrets.enableManagedRotation` `secretmanager.secrets.rotate`
Secret Manager	The following permissions have reached General Availability (GA): `secretmanager.secrets.enableManagedRotation` `secretmanager.secrets.rotate`
VM Migration	The following permissions have been added: `vmmigration.groups.createTagBinding` `vmmigration.groups.deleteTagBinding` `vmmigration.groups.listEffectiveTags` `vmmigration.groups.listTagBindings` `vmmigration.sources.createTagBinding` `vmmigration.sources.deleteTagBinding` `vmmigration.sources.listEffectiveTags` `vmmigration.sources.listTagBindings`
VM Migration	The following permissions have reached General Availability (GA): `vmmigration.groups.createTagBinding` `vmmigration.groups.deleteTagBinding` `vmmigration.groups.listEffectiveTags` `vmmigration.groups.listTagBindings` `vmmigration.sources.createTagBinding` `vmmigration.sources.deleteTagBinding` `vmmigration.sources.listEffectiveTags` `vmmigration.sources.listTagBindings`

IAM changes for the week of 2026-07-14

Service	Description
Database Migration Service	The following permissions have been added to the Database Migration Service Agent role (`roles/datamigration.serviceAgent`): `alloydb.backups.create` `alloydb.backups.get` `alloydb.backups.list` `cloudsql.backupRuns.create` `cloudsql.backupRuns.export` `cloudsql.backupRuns.get` `cloudsql.backupRuns.list` `cloudsql.instances.restoreBackup`
Managed Service for Apache Spark	The following permissions have been added to the Dataproc Service Agent role (`roles/dataproc.serviceAgent`): `compute.networks.create` `compute.subnetworks.create`
Datastream	The following permissions have been added to the Datastream Admin role (`roles/datastream.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Discovery Engine	The following permissions have been added to the Discovery Engine Service Agent role (`roles/discoveryengine.serviceAgent`): `aiplatform.endpoints.predict`
Cluster Director	The following permissions have been added to the Cluster Director Service Agent role (`roles/hypercomputecluster.serviceAgent`): `container.deployments.get` `container.deployments.list` `container.jobs.get` `container.jobs.list`
Cloud Run	The following permissions have been added to the Cloud Run Invoker role (`roles/run.invoker`): `run.instances.invoke`
BigQuery sharing	The following permissions have been added: `analyticshub.queryTemplates.approve` `analyticshub.queryTemplates.create` `analyticshub.queryTemplates.delete` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `analyticshub.queryTemplates.update`
BigQuery sharing	The following permissions are supported in custom roles: `analyticshub.queryTemplates.approve` `analyticshub.queryTemplates.create` `analyticshub.queryTemplates.delete` `analyticshub.queryTemplates.get` `analyticshub.queryTemplates.list` `analyticshub.queryTemplates.update`
Knowledge Catalog	The following permissions have reached General Availability (GA): `dataplex.entryGroups.useDescriptionsAspect` `dataplex.entryGroups.useQueriesAspect` `dataplex.entryGroups.useSchemaJoinAspect` `dataplex.entryGroups.useSchemaJoinEntryLink`
Datastream	The following permissions have been added: `datastream.connectionProfiles.deriveDestinationSchema`
Datastream	The following permissions are supported in custom roles: `datastream.connectionProfiles.deriveDestinationSchema`
Datastream	The following permissions have reached General Availability (GA): `datastream.connectionProfiles.deriveDestinationSchema`
Cloud Run	The following permissions have been added: `run.instances.create` `run.instances.delete` `run.instances.get` `run.instances.getIamPolicy` `run.instances.invoke` `run.instances.list` `run.instances.setIamPolicy` `run.instances.start` `run.instances.stop` `run.instances.update`
Cloud Run	The following permissions are supported in custom roles: `run.instances.create` `run.instances.delete` `run.instances.get` `run.instances.getIamPolicy` `run.instances.invoke` `run.instances.list` `run.instances.setIamPolicy` `run.instances.start` `run.instances.stop` `run.instances.update`

IAM changes for the week of 2026-07-07

Service	Description
Gemini Enterprise for Customer Experience	The following permissions have been added to the Customer Engagement Suite Service Agent role (`roles/ces.serviceAgent`): `ces.agents.create` `ces.agents.delete` `ces.agents.get` `ces.agents.list` `ces.agents.update` `ces.appVersions.delete` `ces.appVersions.list` `ces.appVersions.restore` `ces.apps.create` `ces.apps.delete` `ces.apps.export` `ces.apps.import` `ces.apps.list` `ces.apps.update` `ces.changelogs.get` `ces.changelogs.list` `ces.conversations.get` `ces.conversations.list` `ces.deployments.create` `ces.deployments.delete` `ces.deployments.get` `ces.deployments.list` `ces.deployments.update` `ces.evaluationDatasets.create` `ces.evaluationDatasets.delete` `ces.evaluationDatasets.get` `ces.evaluationDatasets.list` `ces.evaluationDatasets.update` `ces.evaluationResults.delete` `ces.evaluationResults.list` `ces.evaluationRuns.delete` `ces.evaluationRuns.list` `ces.evaluations.create` `ces.evaluations.delete` `ces.evaluations.get` `ces.evaluations.list` `ces.evaluations.update` `ces.guardrails.create` `ces.guardrails.delete` `ces.guardrails.get` `ces.guardrails.list` `ces.guardrails.update` `ces.tools.create` `ces.tools.delete` `ces.tools.get` `ces.tools.list` `ces.tools.update` `ces.toolsets.create` `ces.toolsets.delete` `ces.toolsets.get` `ces.toolsets.list` `ces.toolsets.update`
Cloud Asset Inventory	The Cloud Asset Admin role (`roles/cloudasset.admin`) has reached General Availability (GA).
Cloud Asset Inventory	The Cloud Asset Editor role (`roles/cloudasset.editor`) has reached General Availability (GA).
Data Catalog	The following permissions have been added to the Data Catalog Admin role (`roles/datacatalog.admin`): `dataplex.locations.get` `dataplex.locations.list`
Data Catalog	The following permissions have been added to the Data Catalog Editor role (`roles/datacatalog.editor`): `dataplex.locations.get` `dataplex.locations.list`
Data Catalog	The following permissions have been added to the Data Catalog Viewer role (`roles/datacatalog.viewer`): `dataplex.locations.get` `dataplex.locations.list`
Knowledge Catalog	The following permissions have been added to the Dataplex Catalog Editor role (`roles/dataplex.catalogEditor`): `dataplex.locations.get` `dataplex.locations.list`
Knowledge Catalog	The following permissions have been added to the Dataplex Catalog Viewer role (`roles/dataplex.catalogViewer`): `dataplex.locations.get` `dataplex.locations.list`
Discovery Engine	The Cloud NotebookLM Notebook Editor role (`roles/discoveryengine.notebookEditor`) has reached General Availability (GA).
Discovery Engine	The Cloud NotebookLM Admin role (`roles/discoveryengine.notebookLmOwner`) has reached General Availability (GA).
Discovery Engine	The Cloud NotebookLM User role (`roles/discoveryengine.notebookLmUser`) has reached General Availability (GA).
Discovery Engine	The Cloud NotebookLM Notebook Owner role (`roles/discoveryengine.notebookOwner`) has reached General Availability (GA).
Discovery Engine	The Cloud NotebookLM Notebook Viewer role (`roles/discoveryengine.notebookViewer`) has reached General Availability (GA).
Discovery Engine	The following permissions have been added to the Discovery Engine Admin role (`roles/discoveryengine.admin`): `cloudtrace.insights.get` `cloudtrace.insights.list` `cloudtrace.stats.get` `cloudtrace.tasks.create` `cloudtrace.tasks.delete` `cloudtrace.tasks.get` `cloudtrace.tasks.list` `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update` `cloudtrace.traces.get` `cloudtrace.traces.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logScopes.get` `logging.logScopes.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.getShared` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `observability.scopes.get` `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Discovery Engine	The following permissions have been added to the Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin`): `cloudtrace.insights.get` `cloudtrace.insights.list` `cloudtrace.stats.get` `cloudtrace.tasks.create` `cloudtrace.tasks.delete` `cloudtrace.tasks.get` `cloudtrace.tasks.list` `cloudtrace.traceScopes.create` `cloudtrace.traceScopes.delete` `cloudtrace.traceScopes.get` `cloudtrace.traceScopes.list` `cloudtrace.traceScopes.update` `cloudtrace.traces.get` `cloudtrace.traces.list` `logging.buckets.get` `logging.buckets.list` `logging.exclusions.get` `logging.exclusions.list` `logging.links.get` `logging.links.list` `logging.locations.get` `logging.locations.list` `logging.logEntries.list` `logging.logMetrics.get` `logging.logMetrics.list` `logging.logScopes.get` `logging.logScopes.list` `logging.logServiceIndexes.list` `logging.logServices.list` `logging.logs.list` `logging.operations.get` `logging.operations.list` `logging.queries.create` `logging.queries.delete` `logging.queries.get` `logging.queries.getShared` `logging.queries.list` `logging.queries.listShared` `logging.queries.update` `logging.queries.usePrivate` `logging.sinks.get` `logging.sinks.list` `logging.usage.get` `logging.views.get` `logging.views.list` `observability.scopes.get` `observability.traceScopes.create` `observability.traceScopes.delete` `observability.traceScopes.get` `observability.traceScopes.list` `observability.traceScopes.update`
Cloud DNS	The DNS Editor role (`roles/dns.editor`) has reached General Availability (GA).
Cloud DNS	The DNS Viewer role (`roles/dns.viewer`) has reached General Availability (GA).
Firebase Data Connect	The following permissions have been added to the Firebase Data Connect Service Agent role (`roles/firebasedataconnect.serviceAgent`): `cloudsql.instances.create` `cloudsql.instances.update`
IAM Connectors	The following permissions have been added to the Connector Admin role (`roles/iamconnectors.admin`): `agentidentity.authorizations.delete`
IAM Connectors	The following permissions have been added to the Connector Editor role (`roles/iamconnectors.editor`): `agentidentity.authorizations.delete`
Multi-Cluster Ingress	The following permissions have been added to the Multi Cluster Ingress Service Agent role (`roles/multiclusteringress.serviceAgent`): `networkservices.serviceLbPolicies.create` `networkservices.serviceLbPolicies.delete` `networkservices.serviceLbPolicies.get` `networkservices.serviceLbPolicies.list` `networkservices.serviceLbPolicies.update`
Network Connectivity Center	The following permissions have been added to the Service Automation Consumer Network Admin role (`roles/networkconnectivity.consumerNetworkAdmin`): `networkconnectivity.operations.cancel` `networkconnectivity.operations.delete` `networkconnectivity.operations.get` `networkconnectivity.operations.list`
AI Commerce Search API	The following permissions have been added to the Retail Merchant Approver role (`roles/retail.merchantApprover`): `retail.controls.delete` `retail.controls.update` `retail.servingConfigs.update`
Agent Identity API	The following permissions have been added: `agentidentity.accessSummaries.get` `agentidentity.accessSummaries.list` `agentidentity.authProviders.create` `agentidentity.authProviders.delete` `agentidentity.authProviders.get` `agentidentity.authProviders.getIamPolicy` `agentidentity.authProviders.list` `agentidentity.authProviders.queryWorkloads` `agentidentity.authProviders.retrieveCredentials` `agentidentity.authProviders.revokeAuthorizations` `agentidentity.authProviders.setIamPolicy` `agentidentity.authProviders.undelete` `agentidentity.authProviders.update` `agentidentity.authorizations.delete` `agentidentity.authorizations.get` `agentidentity.authorizations.list` `agentidentity.locations.get` `agentidentity.locations.list`
Agent Identity API	The following permissions are supported in custom roles: `agentidentity.accessSummaries.get` `agentidentity.accessSummaries.list` `agentidentity.authProviders.create` `agentidentity.authProviders.delete` `agentidentity.authProviders.get` `agentidentity.authProviders.getIamPolicy` `agentidentity.authProviders.list` `agentidentity.authProviders.queryWorkloads` `agentidentity.authProviders.retrieveCredentials` `agentidentity.authProviders.revokeAuthorizations` `agentidentity.authProviders.setIamPolicy` `agentidentity.authProviders.undelete` `agentidentity.authProviders.update` `agentidentity.authorizations.delete` `agentidentity.authorizations.get` `agentidentity.authorizations.list` `agentidentity.locations.get` `agentidentity.locations.list`
Backup and Disaster Recovery	The following permissions have been added: `backupdr.backupPlanAssociations.updateForCloudSqlInstance`
BigLake	The following permissions have been added: `biglake.tables.register`
BigLake	The following permissions are supported in custom roles: `biglake.tables.register`
Business AI Code	The following permissions have been added: `businessaicode.locations.selfAssignLicense`
Business AI Code	The following permissions are supported in custom roles: `businessaicode.locations.selfAssignLicense`
Knowledge Catalog	The following permissions have been added: `dataplex.entryGroups.useContextAspect` `dataplex.entryGroups.useContextEntry` `dataplex.entryGroups.useContextEntryLink`
Knowledge Catalog	The following permissions are supported in custom roles: `dataplex.entryGroups.useContextAspect` `dataplex.entryGroups.useContextEntry` `dataplex.entryGroups.useContextEntryLink`
Knowledge Catalog	The following permissions have reached General Availability (GA): `dataplex.entryGroups.useContextAspect` `dataplex.entryGroups.useContextEntry` `dataplex.entryGroups.useContextEntryLink`
Managed Service for Apache Spark	The following permissions have been added: `dataproc.batches.computeTuningConfig`
Managed Service for Apache Spark	The following permissions are supported in custom roles: `dataproc.batches.computeTuningConfig`
Managed Service for Apache Spark	The following permissions have reached General Availability (GA): `dataproc.batches.computeTuningConfig`
Discovery Engine	The following permissions have been added: `discoveryengine.devToolsConfigs.get` `discoveryengine.devToolsConfigs.update` `discoveryengine.projects.update`
Discovery Engine	The following permissions are supported in custom roles: `discoveryengine.devToolsConfigs.get` `discoveryengine.devToolsConfigs.update` `discoveryengine.projects.update`
Memorystore	The following permissions have been added: `memorystore.instances.finishMigration` `memorystore.instances.startMigration`
Memorystore	The following permissions are supported in custom roles: `memorystore.instances.finishMigration` `memorystore.instances.startMigration`
Memorystore	The following permissions have reached General Availability (GA): `memorystore.instances.finishMigration` `memorystore.instances.startMigration`
Network Security	The following permissions have been added: `networksecurity.firewallEndpoints.createVerdictChangeRequest` `networksecurity.firewallEndpoints.getVerdictChangeRequest` `networksecurity.firewallEndpoints.getWildfireReport` `networksecurity.firewallEndpoints.getWildfireSample` `networksecurity.firewallEndpoints.listVerdictChangeRequests`
Network Security	The following permissions have reached General Availability (GA): `networksecurity.interceptDeploymentGroups.create` `networksecurity.interceptDeploymentGroups.delete` `networksecurity.interceptDeploymentGroups.get` `networksecurity.interceptDeploymentGroups.list` `networksecurity.interceptDeploymentGroups.update` `networksecurity.interceptDeploymentGroups.use` `networksecurity.interceptDeployments.create` `networksecurity.interceptDeployments.delete` `networksecurity.interceptDeployments.get` `networksecurity.interceptDeployments.list` `networksecurity.interceptDeployments.update` `networksecurity.interceptEndpointGroupAssociations.create` `networksecurity.interceptEndpointGroupAssociations.delete` `networksecurity.interceptEndpointGroupAssociations.get` `networksecurity.interceptEndpointGroupAssociations.list` `networksecurity.interceptEndpointGroupAssociations.update` `networksecurity.interceptEndpointGroups.create` `networksecurity.interceptEndpointGroups.delete` `networksecurity.interceptEndpointGroups.get` `networksecurity.interceptEndpointGroups.list` `networksecurity.interceptEndpointGroups.update` `networksecurity.interceptEndpointGroups.use` `networksecurity.mirroringDeploymentGroups.create` `networksecurity.mirroringDeploymentGroups.delete` `networksecurity.mirroringDeploymentGroups.get` `networksecurity.mirroringDeploymentGroups.list` `networksecurity.mirroringDeploymentGroups.update` `networksecurity.mirroringDeploymentGroups.use` `networksecurity.mirroringDeployments.create` `networksecurity.mirroringDeployments.delete` `networksecurity.mirroringDeployments.get` `networksecurity.mirroringDeployments.list` `networksecurity.mirroringDeployments.update` `networksecurity.mirroringEndpointGroupAssociations.create` `networksecurity.mirroringEndpointGroupAssociations.delete` `networksecurity.mirroringEndpointGroupAssociations.get` `networksecurity.mirroringEndpointGroupAssociations.list` `networksecurity.mirroringEndpointGroupAssociations.update` `networksecurity.mirroringEndpointGroups.create` `networksecurity.mirroringEndpointGroups.delete` `networksecurity.mirroringEndpointGroups.get` `networksecurity.mirroringEndpointGroups.list` `networksecurity.mirroringEndpointGroups.update` `networksecurity.mirroringEndpointGroups.use`
Parameter Manager	The following permissions have been added: `parametermanager.parameters.createTagBinding` `parametermanager.parameters.deleteTagBinding` `parametermanager.parameters.listEffectiveTags` `parametermanager.parameters.listTagBindings` `parametermanager.templateVersions.create` `parametermanager.templateVersions.delete` `parametermanager.templateVersions.get` `parametermanager.templateVersions.list` `parametermanager.templateVersions.render` `parametermanager.templateVersions.update` `parametermanager.templates.create` `parametermanager.templates.delete` `parametermanager.templates.get` `parametermanager.templates.list` `parametermanager.templates.update`
Parameter Manager	The following permissions are supported in custom roles: `parametermanager.parameters.createTagBinding` `parametermanager.parameters.deleteTagBinding` `parametermanager.parameters.listEffectiveTags` `parametermanager.parameters.listTagBindings` `parametermanager.templateVersions.create` `parametermanager.templateVersions.delete` `parametermanager.templateVersions.get` `parametermanager.templateVersions.list` `parametermanager.templateVersions.render` `parametermanager.templateVersions.update` `parametermanager.templates.create` `parametermanager.templates.delete` `parametermanager.templates.get` `parametermanager.templates.list` `parametermanager.templates.update`

IAM changes for the week of 2026-06-30

Service	Description
Dialogflow	The following permissions have been added to the Dialogflow Service Agent role (`roles/dialogflow.serviceAgent`): `discoveryengine.collections.get` `discoveryengine.dataStores.get`
Vector Search	The following permissions have been added to the Vector Search Service Agent role (`roles/vectorsearch.serviceAgent`): `discoveryengine.rankingConfigs.rank`
Workload Identity API	The Workload Identity API Admin role (`roles/workloadidentity.admin`) has reached General Availability (GA).
Workload Identity API	The Workload Identity API Viewer role (`roles/workloadidentity.viewer`) has reached General Availability (GA).
Cloud Workstations	The following permissions have been removed from the Cloud Workstations Editor role (`roles/workstations.editor`): `workstations.workstations.use`
Gemini Enterprise Agent Platform	The following permissions have been added: `aiplatform.analyzedInvocations.get` `aiplatform.analyzedInvocations.list` `aiplatform.evaluationMetrics.create` `aiplatform.evaluationMetrics.delete` `aiplatform.evaluationMetrics.get` `aiplatform.evaluationMetrics.list`
Gemini Enterprise Agent Platform	The following permissions have reached General Availability (GA): `aiplatform.onlineEvaluators.create` `aiplatform.onlineEvaluators.delete` `aiplatform.onlineEvaluators.get` `aiplatform.onlineEvaluators.list` `aiplatform.onlineEvaluators.update` `aiplatform.semanticGovernancePolicies.create` `aiplatform.semanticGovernancePolicies.delete` `aiplatform.semanticGovernancePolicies.get` `aiplatform.semanticGovernancePolicies.list` `aiplatform.semanticGovernancePolicies.update` `aiplatform.semanticGovernancePolicyEngine.get` `aiplatform.semanticGovernancePolicyEngine.update`
Cloud Key Management Service	The following permissions have been added: `cloudkms.cryptoKeyVersions.trustedImportExport` `cloudkms.folders.showEffectiveAutokeyConfig`
Cloud Key Management Service	The following permissions are supported in custom roles: `cloudkms.folders.showEffectiveAutokeyConfig`
Cloud Key Management Service	The following permissions have reached General Availability (GA): `cloudkms.cryptoKeyVersions.trustedImportExport` `cloudkms.folders.showEffectiveAutokeyConfig`
Compute Engine	The following permissions have been added: `compute.advice.capacity` `compute.advice.capacityHistory`
Compute Engine	The following permissions have reached General Availability (GA): `compute.advice.capacity` `compute.advice.capacityHistory`
Knowledge Catalog	The following permissions have been added: `dataplex.dataDomainBindings.create` `dataplex.dataDomainBindings.delete` `dataplex.dataDomainBindings.get` `dataplex.dataDomainBindings.list` `dataplex.dataDomains.create` `dataplex.dataDomains.delete` `dataplex.dataDomains.discover` `dataplex.dataDomains.get` `dataplex.dataDomains.getIamPolicy` `dataplex.dataDomains.list` `dataplex.dataDomains.lookupEntry` `dataplex.dataDomains.modifyEntry` `dataplex.dataDomains.setIamPolicy` `dataplex.dataDomains.update`
Knowledge Catalog	The following permissions are supported in custom roles: `dataplex.dataDomainBindings.create` `dataplex.dataDomainBindings.delete` `dataplex.dataDomainBindings.get` `dataplex.dataDomainBindings.list` `dataplex.dataDomains.create` `dataplex.dataDomains.delete` `dataplex.dataDomains.discover` `dataplex.dataDomains.get` `dataplex.dataDomains.getIamPolicy` `dataplex.dataDomains.list` `dataplex.dataDomains.lookupEntry` `dataplex.dataDomains.modifyEntry` `dataplex.dataDomains.setIamPolicy` `dataplex.dataDomains.update`
Google Cloud NetApp Volumes	The following permissions have been added: `netapp.backups.useReadOnly` `netapp.volumes.createCrossProjectBackup`
Oracle Database@Google Cloud	The following permissions have been added: `oracledatabase.autonomousDatabaseBackups.clone` `oracledatabase.autonomousDatabases.clone` `oracledatabase.autonomousDatabases.listRefreshableClones` `oracledatabase.autonomousDatabases.refresh`
Oracle Database@Google Cloud	The following permissions are supported in custom roles: `oracledatabase.autonomousDatabaseBackups.clone` `oracledatabase.autonomousDatabases.clone` `oracledatabase.autonomousDatabases.listRefreshableClones` `oracledatabase.autonomousDatabases.refresh`
Oracle Database@Google Cloud	The following permissions have reached General Availability (GA): `oracledatabase.autonomousDatabaseBackups.clone` `oracledatabase.autonomousDatabases.clone` `oracledatabase.autonomousDatabases.listRefreshableClones` `oracledatabase.autonomousDatabases.refresh`
Workload Identity API	The following permissions have been added: `workloadidentity.locations.get` `workloadidentity.locations.list` `workloadidentity.operations.cancel` `workloadidentity.operations.delete` `workloadidentity.operations.get` `workloadidentity.operations.list` `workloadidentity.serviceAgents.create`
Workload Identity API	The following permissions are supported in custom roles: `workloadidentity.locations.get` `workloadidentity.locations.list` `workloadidentity.operations.cancel` `workloadidentity.operations.delete` `workloadidentity.operations.get` `workloadidentity.operations.list` `workloadidentity.serviceAgents.create`
Workload Identity API	The following permissions have reached General Availability (GA): `workloadidentity.locations.get` `workloadidentity.locations.list` `workloadidentity.operations.cancel` `workloadidentity.operations.delete` `workloadidentity.operations.get` `workloadidentity.operations.list` `workloadidentity.serviceAgents.create`

IAM changes for the week of 2026-06-23

Service	Description
Access Context Manager	The following permissions have been added to the VPC Service Controls Troubleshooter Viewer role (`roles/accesscontextmanager.vpcScTroubleshooterViewer`): `iam.roles.get`
Gemini Enterprise Agent Platform	The following permissions have been added to the Vertex AI Service Agent role (`roles/aiplatform.serviceAgent`): `compute.instanceGroupManagers.update` `logging.operations.get` `logging.operations.list` `observability.operations.get` `observability.operations.list`
API Hub	The following permissions have been added to the Cloud API Hub Admin role (`roles/apihub.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
API Hub	The following permissions have been added to the Cloud API hub Provisioning Admin role (`roles/apihub.provisioningAdmin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
App Engine	The Appengine Admin role (`roles/appengine.admin`) has reached General Availability (GA).
App Engine	The Appengine Editor role (`roles/appengine.editor`) has reached General Availability (GA).
App Engine	The Appengine Viewer role (`roles/appengine.viewer`) has reached General Availability (GA).
Google Security Operations	The following permissions have been added to the Chronicle API Editor role (`roles/chronicle.editor`): `chronicle.moduleSettingsProperties.get`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Admin role (`roles/chronicle.soarAdmin`): `chronicle.preferenceSets.update`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Threat Manager role (`roles/chronicle.soarThreatManager`): `chronicle.dataAccessScopes.list` `chronicle.environmentGroups.get` `chronicle.instances.get` `chronicle.integrations.get` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarUsers.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.socRoles.get` `chronicle.userLocalizations.get` `chronicle.userNotifications.get`
Google Security Operations	The following permissions have been added to the Chronicle SOAR Vulnerability Manager role (`roles/chronicle.soarVulnerabilityManager`): `chronicle.dataAccessScopes.list` `chronicle.environmentGroups.get` `chronicle.instances.get` `chronicle.integrations.get` `chronicle.legacySoarAdvancedReports.get` `chronicle.legacySoarUsers.get` `chronicle.moduleSettings.rebranding` `chronicle.moduleSettingsProperties.get` `chronicle.preferenceSets.get` `chronicle.preferenceSets.update` `chronicle.socRoles.get` `chronicle.userLocalizations.get` `chronicle.userNotifications.get`
Google Security Operations	The following permissions have been added to the Chronicle API Viewer role (`roles/chronicle.viewer`): `chronicle.moduleSettingsProperties.get` `chronicle.userLocalizations.get` `chronicle.userNotifications.get`
Developer Connect	The following permissions have been added to the Developer Connect Service Agent role (`roles/developerconnect.serviceAgent`): `developerconnect.connections.get`
Discovery Engine	The following permissions have been added to the Gemini Enterprise User role (`roles/discoveryengine.agentspaceUser`): `discoveryengine.collections.get` `discoveryengine.dataStores.get`
Discovery Engine	The following permissions have been added to the Podcast API User role (`roles/discoveryengine.podcastApiUser`): `discoveryengine.collections.get` `discoveryengine.dataStores.get`
Discovery Engine	The following permissions have been added to the Discovery Engine User role (`roles/discoveryengine.user`): `discoveryengine.collections.get` `discoveryengine.dataStores.get`
Firebase Telemetry	The Firebase Telemetry Service Agent role (`roles/firebasetelemetry.serviceAgent`) has reached General Availability (GA).
Backup for GKE	The following permissions have been added to the Backup for GKE Admin role (`roles/gkebackup.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Cluster Director	The following permissions have been added to the Cluster Director Service Agent role (`roles/hypercomputecluster.serviceAgent`): `hypercomputecluster.machineLearningRuns.create` `hypercomputecluster.machineLearningRuns.delete` `hypercomputecluster.machineLearningRuns.get` `hypercomputecluster.machineLearningRuns.list` `hypercomputecluster.machineLearningRuns.update` `hypercomputecluster.operations.cancel` `hypercomputecluster.operations.delete` `hypercomputecluster.operations.get` `hypercomputecluster.operations.list`
Cloud Monitoring	The Monitoring Alert Viewer role (`roles/monitoring.alertViewer`) has reached General Availability (GA).
Network Connectivity Center	The following permissions have been added to the Network Connectivity Service Agent role (`roles/networkconnectivity.serviceAgent`): `compute.serviceAttachments.get` `compute.serviceAttachments.update`
Secret Manager	The Secretmanager Editor role (`roles/secretmanager.editor`) has reached General Availability (GA).
Workflows	The following permissions have been added to the Workflows Admin role (`roles/workflows.admin`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Workflows	The following permissions have been added to the Workflows Editor role (`roles/workflows.editor`): `cloudkms.keyHandles.create` `cloudkms.keyHandles.get` `cloudkms.keyHandles.list` `cloudkms.operations.get` `cloudkms.projects.showEffectiveAutokeyConfig`
Bare Metal Solution	The following permissions have been added: `baremetalsolution.luns.onDemandEvict` `baremetalsolution.volumes.onDemandEvict`
Bare Metal Solution	The following permissions are supported in custom roles: `baremetalsolution.luns.onDemandEvict` `baremetalsolution.volumes.onDemandEvict`
Bare Metal Solution	The following permissions have reached General Availability (GA): `baremetalsolution.luns.onDemandEvict` `baremetalsolution.volumes.onDemandEvict`
Google Security Operations	The following permissions have been added: `chronicle.connectorEvents.get` `chronicle.featuredContentPlaybooks.get` `chronicle.featuredContentPlaybooks.install` `chronicle.featuredContentPlaybooks.list` `chronicle.moduleSettings.modifyCaseList`
Google Security Operations	The following permissions are supported in custom roles: `chronicle.connectorEvents.get` `chronicle.featuredContentPlaybooks.get` `chronicle.featuredContentPlaybooks.install` `chronicle.featuredContentPlaybooks.list` `chronicle.moduleSettings.modifyCaseList`
Google Security Operations	The following permissions have reached General Availability (GA): `chronicle.caseAlerts.removeTag` `chronicle.caseAlerts.updateTag` `chronicle.caseDetections.get` `chronicle.caseEvents.get` `chronicle.caseEvidenceDatas.get`
Cloud Monitoring	The following permissions have reached General Availability (GA): `monitoring.alerts.get` `monitoring.alerts.list`
Cloud Run	The following permissions have been added: `run.instances.sshRead` `run.instances.sshRoot` `run.jobs.sshRead` `run.jobs.sshRoot` `run.services.sshRead` `run.services.sshRoot` `run.workerpools.sshRead` `run.workerpools.sshRoot`
Cloud Run	The following permissions are supported in custom roles: `run.instances.sshRead` `run.instances.sshRoot` `run.jobs.sshRead` `run.jobs.sshRoot` `run.services.sshRead` `run.services.sshRoot` `run.workerpools.sshRead` `run.workerpools.sshRoot`
Workload Manager	The following permissions have been added: `workloadmanager.findings.create` `workloadmanager.findings.list`

IAM changes for the week of 2026-06-09

Service Description

Gemini Enterprise Agent Platform

Service	Description
Gemini Enterprise Agent Platform	The following permissions have been added to the Agent Platform Administrator role (`roles/aiplatform.admin`): `aiplatform.analyzedSessions.aggregate`

The following permissions have been added to the Agent Platform Administrator role (roles/aiplatform.admin):

aiplatform.analyzedSessions.aggregate

IAM permissions change log Stay organized with collections Save and categorize content based on your preferences.