Google’s Data Agent Kit Hits GA, Splitting AI Agent Guardrails Between Skills and Cloud IAM

Google Cloud has promoted its open-source Data Agent Kit to General Availability (GA), giving software engineers and data teams a standardized toolkit to connect everyday coding assistants—including Antigravity, Claude Code, OpenAI Codex, Cursor, and Visual Studio Code—directly to more than 15 Google Data Cloud services. More importantly for production security teams, the release draws a hard architectural line between polite prompt advice and deterministic access enforcement.

Anyone who has connected an autonomous coding agent to a live cloud database knows the main operational problem: coding models write syntactically valid SQL, but they have no built-in awareness of which BigQuery tables are production-critical, how partitions are keyed, or why last night’s Airflow pipeline failed. Worse, giving an agent live database credentials creates the constant hazard that a misunderstood refactoring prompt will trigger an irreversible DROP TABLE or TRUNCATE command.

To solve both problems at once, Google Cloud structured Data Agent Kit around two distinct layers: 37 Apache-2.0 licensed SKILL.md instruction packages that teach coding agents domain best practices, and Model Context Protocol (MCP) server integrations governed by Google Cloud Identity and Access Management (IAM) deny policies. While a skill file advises the model to stop and ask for human confirmation before running destructive operations, the IAM policy layer blocks non-read-only MCP tool executions at the cloud control plane before a query can ever reach the database.

That two-tier guardrail split offers a practical blueprint for any organization deploying autonomous agents against enterprise data warehouses. Rather than trusting an LLM’s system prompt to protect production data, engineering leaders can pair context-rich agent skills with attribute-based IAM rules that enforce read-only investigation across the entire project or organization.

Fast Facts: Google Cloud Data Agent Kit GA & Two-Tier Guardrails

• Release & Licensing: Reached General Availability in October 2026 (v1.0.0 cut September 29; v1.1.0 shipped October 13) under the open-source Apache 2.0 license, as detailed in InfoQ’s architecture analysis.
• Supported Editors & Environments: Works out of the box in Antigravity, Claude Code, Codex, Cursor, and VS Code-compatible IDEs, and ships preinstalled in Google Cloud Shell and Cloud Workstations.
• 15+ Connected Data Services: Exposes live schema and operational tools across BigQuery, BigQuery Graph, Cloud Spanner, Bigtable, Managed Service for Apache Spark, Apache Iceberg lakehouses, Dataform, dbt, and Cloud Composer (Managed Airflow).
• 37 Versioned Agent Skills: Includes specialized SKILL.md modules for BigQuery SQL optimization, Bigtable row-key design, catalog federation across AWS Glue and Databricks Unity Catalog, and accidental-data-loss-prevention.
• Advisory vs. Hard Guardrails: Pairs a prompt-level STOP AND VERIFY instruction skill with a hard Cloud IAM deny condition (api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false) that revokes mcp.googleapis.com/tools.call on mutating tools.

Architecture Comparison: Prompt-Level Skills vs. Cloud IAM MCP Guardrails

Data Agent Kit separates what an agent should know from what an agent is allowed to execute. The table below breaks down how the two control planes operate in practice.

How the Two Guardrail Layers Work Together in Production

Google Cloud Product Manager Arun Nair and Developer Advocate Jeff Nelson designed Data Agent Kit around the daily friction points of data engineering. Instead of forcing engineers to bounce between an IDE, the BigQuery console, schema docs, and Airflow logs, the kit brings live metadata directly into the coding agent via MCP.

1. Layer 1: Teaching Agents Context and Caution via SKILL.md

By default, an LLM asked to clean up a staging environment or optimize a slow query will guess table structures and write aggressive SQL. Data Agent Kit’s 37 skills inject Google-authored operational playbooks directly into the agent’s workflow:

• Schema & Hot-Spot Detection: Before generating a query or Bigtable migration, the agent inspects live partitioning keys and row-key distributions to prevent full-table scans.
• accidental-data-loss-prevention Skill: This module opens with an explicit STOP AND VERIFY directive requiring the agent to halt, explain the blast radius, and wait for human approval before running DROP TABLE, TRUNCATE, DELETE statements lacking a WHERE clause (or using WHERE 1=1), production Cloud Storage deletions, gcloud projects delete, or KMS key destruction.

2. Layer 2: Enforcing Read-Only Containment in Cloud IAM

Because prompt instructions are advisory, relying on accidental-data-loss-prevention alone is never enough for production governance. When asked how teams can isolate read-only troubleshooting from infrastructure modification, Nelson pointed to two deterministic IAM patterns:

1. Service Account Impersonation: Run the local coding agent under short-lived credentials mapped to a strictly read-only service account.
2. Attribute-Based IAM Deny Policies: Apply an organization- or project-level IAM deny rule that inspects the MCP tool’s metadata attribute at invocation time:

api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false

When this condition is active, any attempt by the agent to invoke mcp.googleapis.com/tools.call on a tool that modifies state is rejected immediately by Google Cloud’s control plane. Administrators can further narrow the policy using resource.service and tool.name attributes via the gcloud CLI.

Practical Checklist: Deploying Data Agent Kit Safely Across Your Team

1. Pin Data Agent Kit v1.1.0+ in Version Control: Avoid unpinned plugin installs; commit the versioned Apache-2.0 skill definitions so every developer’s IDE loads the exact same accidental-data-loss-prevention rules.
2. Enforce tool.isReadOnly IAM Deny Policies on Production Projects: Use gcloud iam policies to block mcp.googleapis.com/tools.call whenever tool.isReadOnly is false on production folders, ensuring agents used for incident triage can inspect failed jobs without altering tables.
3. Expect Blocked Tools in tools/list: Remind developers that IAM deny policies filter execution (tools/call) rather than discovery (tools/list), so an agent may still see write tools in its schema list before receiving an IAM denial.
4. Pair IAM Containment with Apache Iceberg Time Travel: For staging environments where agents are granted write permissions to test dbt or Dataform pipelines, enable Apache Iceberg snapshot branching and time travel so any unintended table mutation can be rolled back in seconds.