Roles and permissions

Agent Registry provides the following Identity and Access Management (IAM) roles:

  • Agent Registry API Admin (roles/agentregistry.admin): Perform all actions, including manually registering agents and updating metadata.
  • Agent Registry API Editor (roles/agentregistry.editor): Edit access to Agent Registry resources.
  • Agent Registry API Viewer (roles/agentregistry.viewer): View agents, tools, and their attributes.

Grant appropriate Agent Registry IAM roles to users or groups who will manage or view agents in the registry. To grant roles, you can use the IAM page in the Google Cloud console or the Google Cloud CLI. For detailed instructions, see Manage access to projects, folders, and organizations.

Agent Registry roles

The following table describes Agent Registry IAM roles and their typical responsibilities:

Role

Description

Purpose

Agent Registry API Admin

Perform all actions, including manually registering agents and updating metadata.

  • Register and manage agents and MCP servers.
  • Update tool definitions and endpoints.

Agent Registry API Editor

Edit access to Agent Registry resources.

  • Register and manage agents and MCP servers.
  • Update tool definitions and endpoints.

Agent Registry API Viewer

View agents, tools, and their attributes.

  • Discover available agents and MCP servers.
  • View skills and endpoints for integration.

Agent Registry permissions

The following table lists the permissions that each Agent Registry IAM role has:

(roles/agentregistry.admin)

Full access to Agent Registry API resources.

agentregistry.*

  • agentregistry.agents.get
  • agentregistry.agents.list
  • agentregistry.agents.search
  • agentregistry.bindings.create
  • agentregistry.bindings.delete
  • agentregistry.bindings.fetchAvailable
  • agentregistry.bindings.get
  • agentregistry.bindings.list
  • agentregistry.bindings.update
  • agentregistry.endpoints.get
  • agentregistry.endpoints.list
  • agentregistry.locations.get
  • agentregistry.locations.list
  • agentregistry.mcpServers.get
  • agentregistry.mcpServers.list
  • agentregistry.mcpServers.search
  • agentregistry.operations.cancel
  • agentregistry.operations.delete
  • agentregistry.operations.get
  • agentregistry.operations.list
  • agentregistry.services.create
  • agentregistry.services.delete
  • agentregistry.services.get
  • agentregistry.services.list
  • agentregistry.services.update

(roles/agentregistry.editor)

Edit access to Agent Registry API resources.

agentregistry.agents.*

  • agentregistry.agents.get
  • agentregistry.agents.list
  • agentregistry.agents.search

agentregistry.bindings.fetchAvailable

agentregistry.bindings.get

agentregistry.bindings.list

agentregistry.endpoints.*

  • agentregistry.endpoints.get
  • agentregistry.endpoints.list

agentregistry.locations.*

  • agentregistry.locations.get
  • agentregistry.locations.list

agentregistry.mcpServers.*

  • agentregistry.mcpServers.get
  • agentregistry.mcpServers.list
  • agentregistry.mcpServers.search

agentregistry.operations.*

  • agentregistry.operations.cancel
  • agentregistry.operations.delete
  • agentregistry.operations.get
  • agentregistry.operations.list

agentregistry.services.*

  • agentregistry.services.create
  • agentregistry.services.delete
  • agentregistry.services.get
  • agentregistry.services.list
  • agentregistry.services.update

(roles/agentregistry.viewer)

Readonly access to Agent Registry API resources.

agentregistry.agents.*

  • agentregistry.agents.get
  • agentregistry.agents.list
  • agentregistry.agents.search

agentregistry.bindings.fetchAvailable

agentregistry.bindings.get

agentregistry.bindings.list

agentregistry.endpoints.*

  • agentregistry.endpoints.get
  • agentregistry.endpoints.list

agentregistry.locations.*

  • agentregistry.locations.get
  • agentregistry.locations.list

agentregistry.mcpServers.*

  • agentregistry.mcpServers.get
  • agentregistry.mcpServers.list
  • agentregistry.mcpServers.search

agentregistry.operations.get

agentregistry.operations.list

agentregistry.services.get

agentregistry.services.list

For more information about IAM permissions, see Find the right predefined roles and IAM roles and permissions index.