IAM 角色和权限

本页面介绍了如何使用 Identity and Access Management (IAM) 控制对 Gemini Enterprise 资源的 API 访问权限和权限。

概览

Google Cloud 提供 IAM，可让您授予对特定 Google Cloud 资源的精细访问权限，并防止对其他资源进行不必要的访问。本页面介绍了 Gemini Enterprise IAM 角色和权限。如需详细了解Google Cloud IAM，请参阅 IAM 文档。

Gemini Enterprise 提供了一组预定义角色，旨在帮助您控制对 Gemini Enterprise 资源的访问权限。 如果预定义角色无法提供您所需的权限集，您还可以创建自己的自定义角色。此外，旧版基本角色（Editor、Viewer、Owner）仍可供您使用，但这些角色提供的控制不如 Gemini Enterprise 角色那样精细。具体而言，基本角色提供的是对整个 Google Cloud 资源的访问权限，而不仅仅是对 Gemini Enterprise 的访问权限。如需了解详情，请参阅基本角色文档。

预定义角色

Gemini Enterprise 提供了一些预定义角色，您可以使用这些角色来为主账号提供更细粒度的权限。您授予主账号的角色决定了该主账号可以执行的操作。主账号可以是个人、群组或服务账号。

如果您拥有相关权限，可向同一主账号授予多个角色，还可随时更改授予主账号的角色。

权限范围较广的角色拥有权限范围较窄的角色的所有权限。例如，Discovery Engine 编辑者角色不但拥有 Discovery Engine 查看者角色的所有权限，还拥有额外的专有权限。同样，Gemini Enterprise Admin 角色包含 Discovery Engine Editor 角色的所有权限，以及其额外的权限。

基本角色（Owner、Editor、Viewer）提供对整个 Google Cloud的权限。 Gemini Enterprise 特有的角色仅提供 Gemini Enterprise 权限，但以下 Google Cloud权限除外，因为这些是 Google Cloud 常规使用所需的权限：

• resourcemanager.projects.get
• resourcemanager.projects.list
• serviceusage.services.list
• serviceusage.services.get

下表列出了 Gemini Enterprise IAM 角色以及每个角色可提供的所有权限的相应列表。

角色	权限
Gemini Enterprise 管理员 （roles/discoveryengine.agentspaceAdmin） 可授予对 Gemini Enterprise 资源的管理员级访问权限。	cloudaicompanion.aiDevToolsSettings.* cloudaicompanion.aiDevToolsSettings.create cloudaicompanion.aiDevToolsSettings.delete cloudaicompanion.aiDevToolsSettings.get cloudaicompanion.aiDevToolsSettings.list cloudaicompanion.aiDevToolsSettings.update cloudaicompanion.codeRepositoryIndexes.* cloudaicompanion.codeRepositoryIndexes.create cloudaicompanion.codeRepositoryIndexes.delete cloudaicompanion.codeRepositoryIndexes.get cloudaicompanion.codeRepositoryIndexes.list cloudaicompanion.codeRepositoryIndexes.update cloudaicompanion.codeToolsSettings.* cloudaicompanion.codeToolsSettings.create cloudaicompanion.codeToolsSettings.delete cloudaicompanion.codeToolsSettings.get cloudaicompanion.codeToolsSettings.list cloudaicompanion.codeToolsSettings.update cloudaicompanion.dataSharingWithGoogleSettings.* cloudaicompanion.dataSharingWithGoogleSettings.create cloudaicompanion.dataSharingWithGoogleSettings.delete cloudaicompanion.dataSharingWithGoogleSettings.get cloudaicompanion.dataSharingWithGoogleSettings.list cloudaicompanion.dataSharingWithGoogleSettings.update cloudaicompanion.geminiGcpEnablementSettings.* cloudaicompanion.geminiGcpEnablementSettings.create cloudaicompanion.geminiGcpEnablementSettings.delete cloudaicompanion.geminiGcpEnablementSettings.get cloudaicompanion.geminiGcpEnablementSettings.list cloudaicompanion.geminiGcpEnablementSettings.update cloudaicompanion.gibqObservabilitySettings.* cloudaicompanion.gibqObservabilitySettings.create cloudaicompanion.gibqObservabilitySettings.delete cloudaicompanion.gibqObservabilitySettings.get cloudaicompanion.gibqObservabilitySettings.list cloudaicompanion.gibqObservabilitySettings.update cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.loggingSettings.* cloudaicompanion.loggingSettings.create cloudaicompanion.loggingSettings.delete cloudaicompanion.loggingSettings.get cloudaicompanion.loggingSettings.list cloudaicompanion.loggingSettings.update cloudaicompanion.operations.* cloudaicompanion.operations.cancel cloudaicompanion.operations.delete cloudaicompanion.operations.get cloudaicompanion.operations.list cloudaicompanion.releaseChannelSettings.* cloudaicompanion.releaseChannelSettings.create cloudaicompanion.releaseChannelSettings.delete cloudaicompanion.releaseChannelSettings.get cloudaicompanion.releaseChannelSettings.list cloudaicompanion.releaseChannelSettings.update cloudaicompanion.repositoryGroups.create cloudaicompanion.repositoryGroups.delete cloudaicompanion.repositoryGroups.get cloudaicompanion.repositoryGroups.getIamPolicy cloudaicompanion.repositoryGroups.list cloudaicompanion.repositoryGroups.setIamPolicy cloudaicompanion.repositoryGroups.update cloudaicompanion.settingBindings.* cloudaicompanion.settingBindings.aiDevToolsSettingsCreate cloudaicompanion.settingBindings.aiDevToolsSettingsDelete cloudaicompanion.settingBindings.aiDevToolsSettingsGet cloudaicompanion.settingBindings.aiDevToolsSettingsList cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate cloudaicompanion.settingBindings.aiDevToolsSettingsUse cloudaicompanion.settingBindings.codeToolsSettingsCreate cloudaicompanion.settingBindings.codeToolsSettingsDelete cloudaicompanion.settingBindings.codeToolsSettingsGet cloudaicompanion.settingBindings.codeToolsSettingsList cloudaicompanion.settingBindings.codeToolsSettingsUpdate cloudaicompanion.settingBindings.codeToolsSettingsUse cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse cloudaicompanion.settingBindings.gibqObservabilitySettingsCreate cloudaicompanion.settingBindings.gibqObservabilitySettingsDelete cloudaicompanion.settingBindings.gibqObservabilitySettingsGet cloudaicompanion.settingBindings.gibqObservabilitySettingsList cloudaicompanion.settingBindings.gibqObservabilitySettingsUpdate cloudaicompanion.settingBindings.gibqObservabilitySettingsUse cloudaicompanion.settingBindings.loggingSettingsCreate cloudaicompanion.settingBindings.loggingSettingsDelete cloudaicompanion.settingBindings.loggingSettingsGet cloudaicompanion.settingBindings.loggingSettingsList cloudaicompanion.settingBindings.loggingSettingsUpdate cloudaicompanion.settingBindings.loggingSettingsUse cloudaicompanion.settingBindings.releaseChannelSettingsCreate cloudaicompanion.settingBindings.releaseChannelSettingsDelete cloudaicompanion.settingBindings.releaseChannelSettingsGet cloudaicompanion.settingBindings.releaseChannelSettingsList cloudaicompanion.settingBindings.releaseChannelSettingsUpdate cloudaicompanion.settingBindings.releaseChannelSettingsUse cloudnotifications.activities.list cloudtrace.insights.* cloudtrace.insights.get cloudtrace.insights.list cloudtrace.stats.get cloudtrace.tasks.* cloudtrace.tasks.create cloudtrace.tasks.delete cloudtrace.tasks.get cloudtrace.tasks.list cloudtrace.traceScopes.* cloudtrace.traceScopes.create cloudtrace.traceScopes.delete cloudtrace.traceScopes.get cloudtrace.traceScopes.list cloudtrace.traceScopes.update cloudtrace.traces.get cloudtrace.traces.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list discoveryengine.accounts.create discoveryengine.aclConfigs.* discoveryengine.aclConfigs.get discoveryengine.aclConfigs.update discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.setIamPolicy discoveryengine.agents.update discoveryengine.alertPolicies.* discoveryengine.alertPolicies.create discoveryengine.alertPolicies.get discoveryengine.alertPolicies.update discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.* discoveryengine.assistants.assist discoveryengine.assistants.create discoveryengine.assistants.delete discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.assistants.update discoveryengine.audioOverviews.* discoveryengine.audioOverviews.create discoveryengine.audioOverviews.delete discoveryengine.audioOverviews.get discoveryengine.audioOverviews.getIceConfig discoveryengine.audioOverviews.sendSdpOffer discoveryengine.authorizations.* discoveryengine.authorizations.create discoveryengine.authorizations.delete discoveryengine.authorizations.get discoveryengine.authorizations.list discoveryengine.authorizations.storeUserAuthorization discoveryengine.authorizations.update discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.* discoveryengine.cannedQueries.create discoveryengine.cannedQueries.delete discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cannedQueries.update discoveryengine.cmekConfigs.* discoveryengine.cmekConfigs.delete discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.cmekConfigs.update discoveryengine.collections.* discoveryengine.collections.delete discoveryengine.collections.get discoveryengine.collections.getIamPolicy discoveryengine.collections.list discoveryengine.collections.setIamPolicy discoveryengine.completionConfigs.* discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.completionConfigs.update discoveryengine.completionSuggestions.* discoveryengine.completionSuggestions.import discoveryengine.completionSuggestions.purge discoveryengine.connectorRuns.* discoveryengine.connectorRuns.cancel discoveryengine.connectorRuns.list discoveryengine.controls.* discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.* discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataConnectors.startConnectorRun discoveryengine.dataConnectors.update discoveryengine.dataStores.* discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.getIamPolicy discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.setIamPolicy discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.devToolsConfigs.* discoveryengine.devToolsConfigs.get discoveryengine.devToolsConfigs.update discoveryengine.documentProcessingConfigs.* discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.* discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.* discoveryengine.engines.create discoveryengine.engines.createEngineUserData discoveryengine.engines.delete discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.setIamPolicy discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.* discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.immersiveArtifacts.* discoveryengine.immersiveArtifacts.create discoveryengine.immersiveArtifacts.delete discoveryengine.immersiveArtifacts.export discoveryengine.immersiveArtifacts.get discoveryengine.immersiveArtifacts.list discoveryengine.immersiveArtifacts.navigate discoveryengine.immersiveArtifacts.update discoveryengine.licenseConfigs.* discoveryengine.licenseConfigs.create discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.licenseConfigs.update discoveryengine.locations.* discoveryengine.locations.buildAuthorizationUrl discoveryengine.locations.completeExternalIdentities discoveryengine.locations.estimateDataSize discoveryengine.locations.exchangeAuthCredentials discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.locations.setUpDataConnector discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notebooks.* discoveryengine.notebooks.create discoveryengine.notebooks.generateGuide discoveryengine.notebooks.get discoveryengine.notebooks.getAnalytics discoveryengine.notebooks.getIamPolicy discoveryengine.notebooks.interactSources discoveryengine.notebooks.list discoveryengine.notebooks.removeSelf discoveryengine.notebooks.setIamPolicy discoveryengine.notebooks.update discoveryengine.notes.* discoveryengine.notes.create discoveryengine.notes.delete discoveryengine.notes.get discoveryengine.notes.update discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.podcasts.create discoveryengine.projectOverageConfigs.get discoveryengine.projects.* discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.projects.update discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.* discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.* discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.* discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.sitemaps.* discoveryengine.sitemaps.create discoveryengine.sitemaps.delete discoveryengine.sitemaps.fetch discoveryengine.sources.* discoveryengine.sources.checkFreshness discoveryengine.sources.create discoveryengine.sources.delete discoveryengine.sources.generateDocumentGuide discoveryengine.sources.get discoveryengine.sources.refresh discoveryengine.sources.update discoveryengine.suggestionDenyListEntries.* discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.* discoveryengine.targetSites.batchCreate discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.* discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.userStores.* discoveryengine.userStores.batchUpdateUserLicenses discoveryengine.userStores.get discoveryengine.userStores.listUserLicenses discoveryengine.userStores.update discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update logging.buckets.get logging.buckets.list logging.buckets.listEffectiveTags logging.buckets.listTagBindings logging.exclusions.get logging.exclusions.list logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.list logging.logMetrics.get logging.logMetrics.list logging.logScopes.get logging.logScopes.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.notificationRules.get logging.notificationRules.list logging.operations.get logging.operations.list logging.queries.getShared logging.queries.listShared logging.queries.usePrivate logging.settings.get logging.sinks.get logging.sinks.list logging.usage.get logging.views.get logging.views.getIamPolicy logging.views.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list observability.scopes.get observability.traceScopes.* observability.traceScopes.create observability.traceScopes.delete observability.traceScopes.get observability.traceScopes.list observability.traceScopes.update opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list
Discovery Engine Editor （roles/discoveryengine.editor） 授予对所有 Discovery Engine 资源的读写权限。	discoveryengine.accounts.create discoveryengine.aclConfigs.get discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.update discoveryengine.alertPolicies.* discoveryengine.alertPolicies.create discoveryengine.alertPolicies.get discoveryengine.alertPolicies.update discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.* discoveryengine.assistants.assist discoveryengine.assistants.create discoveryengine.assistants.delete discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.assistants.update discoveryengine.authorizations.storeUserAuthorization discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.* discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.completionConfigs.update discoveryengine.connectorRuns.list discoveryengine.controls.* discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.* discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataConnectors.startConnectorRun discoveryengine.dataConnectors.update discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.* discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.* discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.create discoveryengine.engines.createEngineUserData discoveryengine.engines.delete discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.* discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.immersiveArtifacts.* discoveryengine.immersiveArtifacts.create discoveryengine.immersiveArtifacts.delete discoveryengine.immersiveArtifacts.export discoveryengine.immersiveArtifacts.get discoveryengine.immersiveArtifacts.list discoveryengine.immersiveArtifacts.navigate discoveryengine.immersiveArtifacts.update discoveryengine.licenseConfigs.* discoveryengine.licenseConfigs.create discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.licenseConfigs.update discoveryengine.locations.completeExternalIdentities discoveryengine.locations.estimateDataSize discoveryengine.locations.exchangeAuthCredentials discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.locations.setUpDataConnector discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.podcasts.create discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.* discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.* discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.* discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.sitemaps.* discoveryengine.sitemaps.create discoveryengine.sitemaps.delete discoveryengine.sitemaps.fetch discoveryengine.suggestionDenyListEntries.* discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.* discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.userStores.batchUpdateUserLicenses discoveryengine.userStores.get discoveryengine.userStores.listUserLicenses discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Gemini Enterprise 用户 （roles/discoveryengine.agentspaceUser） 可授予对 Gemini Enterprise 资源的用户级访问权限。	businessaicode.* businessaicode.locations.fetchQuotaStatus businessaicode.locations.generateContent businessaicode.locations.queryConfiguration businessaicode.locations.selfAssignLicense businessaicode.locations.sendTelemetry cloudaicompanion.companions.* cloudaicompanion.companions.generateChat cloudaicompanion.companions.generateCode cloudaicompanion.entitlements.get cloudaicompanion.instances.* cloudaicompanion.instances.completeCode cloudaicompanion.instances.completeTask cloudaicompanion.instances.exportMetrics cloudaicompanion.instances.generateCode cloudaicompanion.instances.generateText cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.licenses.selfAssign cloudaicompanion.operations.get cloudaicompanion.topics.create discoveryengine.accounts.create discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.requestReview discoveryengine.agents.update discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.assist discoveryengine.authorizations.storeUserAuthorization discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.collections.get discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.removeSuggestion discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.devToolsConfigs.get discoveryengine.engines.createEngineUserData discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getPersonalContext discoveryengine.engines.updateEngineUserData discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.immersiveArtifacts.* discoveryengine.immersiveArtifacts.create discoveryengine.immersiveArtifacts.delete discoveryengine.immersiveArtifacts.export discoveryengine.immersiveArtifacts.get discoveryengine.immersiveArtifacts.list discoveryengine.immersiveArtifacts.navigate discoveryengine.immersiveArtifacts.update discoveryengine.locations.buildAuthorizationUrl discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.get geminicloudassist.agents.invoke resourcemanager.projects.get resourcemanager.projects.list
Gemini Enterprise Restricted User （roles/discoveryengine.agentspaceRestrictedUser） 可授予对 Gemini Enterprise 资源的受限用户级访问权限，以便对同一项目中的多个 Gemini Enterprise 实例进行精细控制。如需使用 Gemini Enterprise，拥有此角色的主账号需要在 Engine 政策中获得不受限制的用户级角色（例如 /agentspaceUser）。	discoveryengine.accounts.create discoveryengine.authorizations.storeUserAuthorization discoveryengine.collections.get discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.devToolsConfigs.get discoveryengine.locations.buildAuthorizationUrl discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update resourcemanager.projects.get resourcemanager.projects.list
Gemini Enterprise Viewer （roles/discoveryengine.agentspaceViewer） 可授予查看 Gemini Enterprise 资源详情的权限。	discoveryengine.aclConfigs.get discoveryengine.agentFiles.list discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.get discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.immersiveArtifacts.export discoveryengine.immersiveArtifacts.get discoveryengine.immersiveArtifacts.list discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.models.get discoveryengine.models.list discoveryengine.notebooks.list discoveryengine.notificationMessages.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.sitemaps.fetch discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.userStores.get discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list
Discovery Engine Viewer （roles/discoveryengine.viewer） 授予对所有 Discovery Engine 资源的读取权限。	discoveryengine.aclConfigs.get discoveryengine.agentFiles.list discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.get discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.immersiveArtifacts.export discoveryengine.immersiveArtifacts.get discoveryengine.immersiveArtifacts.list discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.models.get discoveryengine.models.list discoveryengine.notebooks.list discoveryengine.notificationMessages.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.sitemaps.fetch discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.userStores.get discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list

管理 Gemini Enterprise IAM

您可以使用 Google Cloud 控制台获取和设置 IAM 允许政策及 IAM 角色。如需了解详情，请参阅管理对项目、文件夹和组织的访问权限。

向管理员授予权限

作为项目所有者，您可以向想要成为管理员的用户授予 Gemini Enterprise Admin、Service Usage Consumer 和 Logs Viewer 角色。

请按照以下步骤添加角色：

1. 在 Google Cloud 控制台中，前往 IAM 页面。

   转到 IAM
2. 选择相应项目。
3. 点击 授予访问权限。

4. 在新的主账号字段中，输入用户标识符。 这通常是 Google 账号或用户群组的邮箱。

5. 添加角色：
1. 点击添加其他角色。
2. 在选择角色列表中，选择 Gemini Enterprise Admin。
3. 重复步骤 a 和 b，添加 Service Usage Consumer 和 日志查看器 角色。
6. 点击 Save（保存）。

向用户授予权限

本部分介绍了如何向用户授予访问 Gemini Enterprise 应用所需的项目级角色。根据您的访问模式，选择以下角色之一：

• 访问项目中的所有应用：在项目级授予 Gemini Enterprise User (roles/discoveryengine.agentspaceUser) 角色。
• 仅访问特定应用：在项目级层授予 Gemini Enterprise Restricted User (roles/discoveryengine.agentspaceRestrictedUser) 角色，然后在各个应用上授予 Gemini Enterprise User (roles/discoveryengine.agentspaceUser) 角色。“受限用户”角色本身不会授予对任何应用的访问权限，因此用户只能打开您向其授予“Gemini Enterprise 用户”角色的应用。如需了解详情，请参阅为应用配置访问权限控制。

如需在 Google Cloud 控制台中授予项目级层角色，请按照以下步骤操作：

1. 在 Google Cloud 控制台中，前往 IAM 页面。

   转到 IAM
2. 选择相应项目。
3. 点击 授予访问权限。

4. 在新的主账号字段中，输入用户标识符。这通常是 Google 账号或用户组的电子邮件地址，或者是员工身份池中用户的标识符。如需了解详情，请参阅 允许政策的主账号标识符。

5. 添加项目级角色：

   1. 点击 添加其他角色。

   2. 在选择角色列表中，选择以下角色之一：

      • 如需授予对项目中所有应用的访问权限，请选择 Gemini Enterprise 用户。
      • 如需限制对特定应用的访问权限，请选择 Gemini Enterprise 受限用户。
6. 点击 Save（保存）。

7. 如果您授予了 Gemini Enterprise Restricted User 角色，请针对用户需要访问的每个应用单独授予 Gemini Enterprise User (roles/discoveryengine.agentspaceUser) 角色。如需查看分步说明，请参阅为应用配置访问权限控制。

注意： 除了 IAM 角色之外，用户还需要拥有 Gemini Enterprise 许可。请参阅获取 Gemini Enterprise 许可。

如需允许用户管理和共享应用，请向其授予 Discovery Engine Viewer (roles/discoveryengine.viewer) 角色。

后续步骤

• 了解如何管理对项目、文件夹和组织的访问权限。
• 详细了解 IAM。
• 详细了解基本角色。
• 详细了解自定义角色。