Deprecated IAM permissions

The following Identity and Access Management (IAM) permission will be deprecated and shut down for Gemini Cloud Assist April 8, 2026:

• cloudaicompanion.instances.completeTask

Important: This permission is deprecated for Gemini Cloud Assist only. Other products, such as Gemini Code Assist might still require the use of this permission.

To prepare for this change, take the following steps:

1. Identify any custom IAM roles that you have that control access to the Gemini for Google Cloud API:

   1. In the Google Cloud console, go to the Roles page.

      Go to Roles

   2. In the Google Cloud console toolbar, select your organization or project from the list.

   3. To view role permissions, select the checkbox for one or more roles. An adjacent pane displays any permissions contained in the roles.

      The icons in the Type column indicate if it's a custom role ("factory" icon) or a predefined role (hexagon icon).

      

      To find all the roles that include the cloudaicompanion.instances.completeTask permission, type the permission name (cloudaicompanion.instances.completeTask) in the Filter field at the beginning of the Roles list.

2. Add the new permission. Before April 8, 2026, add the geminicloudassist.agents.invoke permission to your custom roles using the following Google Cloud CLI command:

     gcloud iam roles update ROLE_ID \
       --project="PROJECT_ID" \
       --add-permissions="geminicloudassist.agents.invoke"
   

   Replace the following values:

   • ROLE_ID: The ID for the custom role that you're updating.

   • PROJECT_ID: The ID for the project in which the custom role is defined.

   Once a custom role is updated, all users, groups, and service accounts that are granted that custom role automatically inherit the geminicloudassist.agents.invoke permission.

3. Retain old permissions. Until April 8, 2026, keep the following permissions in your custom roles:

   • cloudaicompanion.instances.completeTask

After April 8, 2026, the old permission is no longer used by Gemini Cloud Assist. You might need to retain this permission in your custom roles if you use other Gemini services, such as Gemini in BigQuery or Gemini Code Assist.

For more information about updating custom roles, see Create and manage custom roles.