iam-helper-for-privileged-access-management
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Command Execution]: The skill uses gcloud CLI commands and local shell scripts to interact with Google Cloud's PAM API. These operations are scoped to the resource hierarchy (project, folder, or organization) provided by the user and are used for their intended administrative purposes.
- [Confirmation Strategy]: A Plan-Validate-Execute pattern is strictly followed for all destructive or state-changing operations, such as creating or deleting entitlements and grants. This ensures that the agent presents a summary of planned changes and waits for explicit user approval before execution, preventing accidental modifications.
- [Hierarchy Management]: The skill includes bash scripts that safely traverse the Google Cloud resource hierarchy. This allows the agent to correctly identify entitlements that may be inherited from parent folders or organizations, ensuring that the principle of least privilege is maintained by finding the most appropriate access scope.
- [Security Best Practices]: The instructions emphasize the use of short-lived, time-bound access (grants) and guide users on the necessary IAM roles, aligning with security best practices for managing privileged access.
Audit Metadata