Google Cloud introduced IAM Helper to automate identity and access management workflows, requiring human confirmation for access-policy changes.

IAM Helper is an agent-facing orchestration and interface layer for Google Cloud Identity and Access Management (IAM). Google says it augments existing engines, including Policy Intelligence and Privileged Access Manager. Its workflows can be invoked by autonomous coding assistants, deployment pipelines, and custom agents.

The Agent Skills package combines workflows, helper scripts, and guardrails using the open Agent Skills standard. Google lists compatibility with Gemini CLI, Gemini Cloud Assist, ADK, Claude Code, and Cursor. The system delegates complex policy evaluation and orchestration to Google Cloud’s backend rather than leaving those tasks solely to administrators or language models.

Read-only diagnosis and policy modification have different approval requirements. Diagnostics and simulations can run automatically, but changes to access policies pause for human-in-the-loop confirmation based on customizable risk tiers. The announcement therefore describes guarded automation rather than unrestricted autonomous permission changes.

Google illustrates the workflow with a hypothetical deployment-permission failure. An agent encountering a 403 error identifies a missing Pub/Sub permission and requests a one-hour just-in-time access grant through Privileged Access Manager. This is an illustrative scenario, not a measured customer result demonstrating a particular time saving.