Deprecated IAM permissions

The following Identity and Access Management (IAM) permissions will be deprecated February 1, 2026:

  • cloudaicompanion.companions.generateChat
  • cloudaicompanion.companions.generateCode

To prepare for this change, take the following steps:

  1. Identify any custom IAM roles that you have that control access to the Gemini for Google Cloud API:

    1. In the Google Cloud console, go to the Roles page.

      Go to Roles

    2. In the Google Cloud console toolbar, select your organization or project from the list.

    3. To view role permissions, select the checkbox for one or more roles. An adjacent pane displays any permissions contained in the roles.

      The icons in the Type column indicate if it's a custom role or a predefined role

      Role type icons.

      If you want to find all the roles that include a specific permission, type the permission name in the Filter field at the beginning of the Roles list.

  2. Add new permissions. Before February 1, 2026, add the following new permissions to your custom roles:

    • cloudaicompanion.instances.completeCode
    • cloudaicompanion.instances.completeTask
    • cloudaicompanion.instances.generateCode
    • cloudaicompanion.instances.generateText

  3. Retain old permissions. Until February 1, 2026, keep the following permissions in your custom roles:

    • cloudaicompanion.companions.generateChat
    • cloudaicompanion.companions.generateCode

After February 1, 2026, you can safely remove the old permissions from your custom roles.

For more information about updating custom roles, see Create and manage custom roles.