# Google’s Data Agent Kit Hits GA, Splitting AI Agent Guardrails Between Skills and Cloud IAM

Google Cloud has promoted its open-source Data Agent Kit to General Availability (GA), giving software engineers and data teams a standardized toolkit to connect everyday coding assistants—including Antigravity, Claude Code, OpenAI Codex, Cursor, and Visual Studio Code—directly to more than 15 Google Data Cloud services. More importantly for production security teams, the release draws a hard architectural line between polite prompt advice and deterministic access enforcement.

Anyone who has connected an autonomous coding agent to a live cloud database knows the main operational problem: coding models write syntactically valid SQL, but they have no built-in awareness of which BigQuery tables are production-critical, how partitions are keyed, or why last night's Airflow pipeline failed. Worse, giving an agent live database credentials creates the constant hazard that a misunderstood refactoring prompt will trigger an irreversible `DROP TABLE` or `TRUNCATE` command.

To solve both problems at once, Google Cloud structured Data Agent Kit around two distinct layers: 37 Apache-2.0 licensed `SKILL.md` instruction packages that teach coding agents domain best practices, and Model Context Protocol (MCP) server integrations governed by Google Cloud Identity and Access Management (IAM) deny policies. While a skill file advises the model to stop and ask for human confirmation before running destructive operations, the IAM policy layer blocks non-read-only MCP tool executions at the cloud control plane before a query can ever reach the database.

That two-tier guardrail split offers a practical blueprint for any organization deploying autonomous agents against enterprise data warehouses. Rather than trusting an LLM's system prompt to protect production data, engineering leaders can pair context-rich agent skills with attribute-based IAM rules that enforce read-only investigation across the entire project or organization.

## Fast Facts: Google Cloud Data Agent Kit GA & Two-Tier Guardrails

- **Release & Licensing**: Reached General Availability in October 2026 (`v1.0.0` cut September 29; `v1.1.0` shipped October 13) under the open-source Apache 2.0 license, as detailed in [InfoQ's architecture analysis](https://www.infoq.com/news/2026/10/data-agent-kit-ga/).
- **Supported Editors & Environments**: Works out of the box in Antigravity, Claude Code, Codex, Cursor, and VS Code-compatible IDEs, and ships preinstalled in Google Cloud Shell and Cloud Workstations.
- **15+ Connected Data Services**: Exposes live schema and operational tools across BigQuery, BigQuery Graph, Cloud Spanner, Bigtable, Managed Service for Apache Spark, Apache Iceberg lakehouses, Dataform, dbt, and Cloud Composer (Managed Airflow).
- **37 Versioned Agent Skills**: Includes specialized `SKILL.md` modules for BigQuery SQL optimization, Bigtable row-key design, catalog federation across AWS Glue and Databricks Unity Catalog, and `accidental-data-loss-prevention`.
- **Advisory vs. Hard Guardrails**: Pairs a prompt-level `STOP AND VERIFY` instruction skill with a hard Cloud IAM deny condition (`api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false`) that revokes `mcp.googleapis.com/tools.call` on mutating tools.

## Architecture Comparison: Prompt-Level Skills vs. Cloud IAM MCP Guardrails

Data Agent Kit separates what an agent *should know* from what an agent *is allowed to execute*. The table below breaks down how the two control planes operate in practice.

| Control Dimension | Layer 1: Agent Skills (`SKILL.md`) | Layer 2: Cloud IAM MCP Deny Policy | Practical Engineering Impact |
|---|---|---|---|
| **Enforcement Mechanism** | Natural-language instructions loaded into the agent's context window | Deterministic Google Cloud IAM condition evaluated on every API call | Prevents prompt injection or model hallucination from bypassing database safety |
| **Destructive Action Handling** | `accidental-data-loss-prevention` instructs agent to halt and ask user consent | Blocks `mcp.googleapis.com/tools.call` whenever `tool.isReadOnly == false` | Guarantees an investigative agent cannot run `DROP`, `TRUNCATE`, or `DELETE` |
| **Target Scope** | Per-session / per-editor workspace plugin (`v1.1.0` pinned in repo) | Google Cloud Organization, Folder, or Project level | Security teams enforce one policy across every developer IDE simultaneously |
| **Granular Attribute Filters** | Scoped by skill frontmatter and task triggers | `tool.isReadOnly`, `resource.service`, and `tool.name` via `gcloud` CLI | Allows read-only BigQuery debugging while blocking KMS or storage deletion |
| **Known Operational Limits** | Advisory only; a confused or jailbroken model can ignore instructions | Blocked tools still appear in `tools/list`; covers Google Cloud MCP servers only | Agents see mutating tools in discovery but receive a hard permission error on call |

## How the Two Guardrail Layers Work Together in Production

Google Cloud Product Manager Arun Nair and Developer Advocate Jeff Nelson designed Data Agent Kit around the daily friction points of data engineering. Instead of forcing engineers to bounce between an IDE, the BigQuery console, schema docs, and Airflow logs, the kit brings live metadata directly into the coding agent via MCP.

### 1. Layer 1: Teaching Agents Context and Caution via `SKILL.md`

By default, an LLM asked to clean up a staging environment or optimize a slow query will guess table structures and write aggressive SQL. Data Agent Kit's 37 skills inject Google-authored operational playbooks directly into the agent's workflow:

- **Schema & Hot-Spot Detection**: Before generating a query or Bigtable migration, the agent inspects live partitioning keys and row-key distributions to prevent full-table scans.
- **`accidental-data-loss-prevention` Skill**: This module opens with an explicit `STOP AND VERIFY` directive requiring the agent to halt, explain the blast radius, and wait for human approval before running `DROP TABLE`, `TRUNCATE`, `DELETE` statements lacking a `WHERE` clause (or using `WHERE 1=1`), production Cloud Storage deletions, `gcloud projects delete`, or KMS key destruction.

### 2. Layer 2: Enforcing Read-Only Containment in Cloud IAM

Because prompt instructions are advisory, relying on `accidental-data-loss-prevention` alone is never enough for production governance. When asked how teams can isolate read-only troubleshooting from infrastructure modification, Nelson pointed to two deterministic IAM patterns:

1. **Service Account Impersonation**: Run the local coding agent under short-lived credentials mapped to a strictly read-only service account.
2. **Attribute-Based IAM Deny Policies**: Apply an organization- or project-level IAM deny rule that inspects the MCP tool's metadata attribute at invocation time:

```
api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false
```

When this condition is active, any attempt by the agent to invoke `mcp.googleapis.com/tools.call` on a tool that modifies state is rejected immediately by Google Cloud's control plane. Administrators can further narrow the policy using `resource.service` and `tool.name` attributes via the `gcloud` CLI.

## Practical Checklist: Deploying Data Agent Kit Safely Across Your Team

1. **Pin Data Agent Kit `v1.1.0+` in Version Control**: Avoid unpinned plugin installs; commit the versioned Apache-2.0 skill definitions so every developer's IDE loads the exact same `accidental-data-loss-prevention` rules.
2. **Enforce `tool.isReadOnly` IAM Deny Policies on Production Projects**: Use `gcloud iam policies` to block `mcp.googleapis.com/tools.call` whenever `tool.isReadOnly` is `false` on production folders, ensuring agents used for incident triage can inspect failed jobs without altering tables.
3. **Expect Blocked Tools in `tools/list`**: Remind developers that IAM deny policies filter execution (`tools/call`) rather than discovery (`tools/list`), so an agent may still see write tools in its schema list before receiving an IAM denial.
4. **Pair IAM Containment with Apache Iceberg Time Travel**: For staging environments where agents are granted write permissions to test dbt or Dataform pipelines, enable Apache Iceberg snapshot branching and time travel so any unintended table mutation can be rolled back in seconds.