Rôles et autorisations IAM

Cette page explique comment contrôler l'accès aux API et les autorisations pour les ressources Gemini Enterprise à l'aide d'Identity and Access Management (IAM).

Présentation

Google Cloud propose IAM, qui vous permet d'attribuer un accès précis à des ressources Google Cloud spécifiques et empêche tout accès non souhaité à d'autres ressources. Cette page décrit les autorisations et les rôles IAM associés à Gemini Enterprise. Pour obtenir une description détaillée deGoogle Cloud IAM, consultez la documentation IAM.

Gemini Enterprise fournit un ensemble de rôles prédéfinis conçus pour vous aider à contrôler l'accès à vos ressources Gemini Enterprise. Si ces rôles ne vous attribuent pas les autorisations dont vous avez besoin, vous pouvez également créer des rôles personnalisés. En outre, les anciens rôles de base (éditeur, lecteur et propriétaire) restent disponibles, même s'ils ne permettent pas un contrôle aussi précis que les rôles Gemini Enterprise. Vous pouvez les utiliser spécifiquement pour accéder à l'ensemble des ressources Google Cloud , et pas uniquement aux ressources Gemini Enterprise. Pour en savoir plus, consultez la documentation sur les rôles de base.

Rôles prédéfinis

Gemini Enterprise fournit des rôles prédéfinis que vous pouvez utiliser pour attribuer des autorisations plus précises aux comptes principaux. Le rôle que vous attribuez à une entité principale définit les actions qu'elle peut entreprendre. Les comptes principaux peuvent être des individus, des groupes ou des comptes de service.

Vous pouvez attribuer plusieurs rôles à une même entité principale et les modifier à tout moment (à condition de disposer des autorisations nécessaires).

Les rôles généraux incluent les rôles plus précis. Par exemple, le rôle d'éditeur Discovery Engine inclut toutes les autorisations du rôle de lecteur Discovery Engine, ainsi que ses propres autorisations supplémentaires. De même, le rôle Administrateur Gemini Enterprise inclut toutes les autorisations du rôle Éditeur Discovery Engine, ainsi que ses propres autorisations supplémentaires.

Les rôles de base (propriétaire, éditeur, lecteur) fournissent des autorisations pour l'ensemble des services Google Cloud. Les rôles propres à Gemini Enterprise n'incluent que les autorisations Gemini Enterprise, à l'exception des autorisations Google Cloudsuivantes, nécessaires pour l'utilisation générale de Google Cloud  :

• resourcemanager.projects.get
• resourcemanager.projects.list
• serviceusage.services.list
• serviceusage.services.get

Le tableau suivant répertorie les rôles IAM Gemini Enterprise, ainsi que la liste de toutes les autorisations incluses dans chaque rôle.

Rôle	Autorisations
Administrateur Gemini Enterprise (roles/discoveryengine.agentspaceAdmin) Accorde un accès de niveau administrateur aux ressources Gemini Enterprise.	cloudaicompanion.aiDevToolsSettings.* cloudaicompanion.aiDevToolsSettings.create cloudaicompanion.aiDevToolsSettings.delete cloudaicompanion.aiDevToolsSettings.get cloudaicompanion.aiDevToolsSettings.list cloudaicompanion.aiDevToolsSettings.update cloudaicompanion.codeRepositoryIndexes.* cloudaicompanion.codeRepositoryIndexes.create cloudaicompanion.codeRepositoryIndexes.delete cloudaicompanion.codeRepositoryIndexes.get cloudaicompanion.codeRepositoryIndexes.list cloudaicompanion.codeRepositoryIndexes.update cloudaicompanion.codeToolsSettings.* cloudaicompanion.codeToolsSettings.create cloudaicompanion.codeToolsSettings.delete cloudaicompanion.codeToolsSettings.get cloudaicompanion.codeToolsSettings.list cloudaicompanion.codeToolsSettings.update cloudaicompanion.dataSharingWithGoogleSettings.* cloudaicompanion.dataSharingWithGoogleSettings.create cloudaicompanion.dataSharingWithGoogleSettings.delete cloudaicompanion.dataSharingWithGoogleSettings.get cloudaicompanion.dataSharingWithGoogleSettings.list cloudaicompanion.dataSharingWithGoogleSettings.update cloudaicompanion.geminiGcpEnablementSettings.* cloudaicompanion.geminiGcpEnablementSettings.create cloudaicompanion.geminiGcpEnablementSettings.delete cloudaicompanion.geminiGcpEnablementSettings.get cloudaicompanion.geminiGcpEnablementSettings.list cloudaicompanion.geminiGcpEnablementSettings.update cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.loggingSettings.* cloudaicompanion.loggingSettings.create cloudaicompanion.loggingSettings.delete cloudaicompanion.loggingSettings.get cloudaicompanion.loggingSettings.list cloudaicompanion.loggingSettings.update cloudaicompanion.operations.* cloudaicompanion.operations.cancel cloudaicompanion.operations.delete cloudaicompanion.operations.get cloudaicompanion.operations.list cloudaicompanion.releaseChannelSettings.* cloudaicompanion.releaseChannelSettings.create cloudaicompanion.releaseChannelSettings.delete cloudaicompanion.releaseChannelSettings.get cloudaicompanion.releaseChannelSettings.list cloudaicompanion.releaseChannelSettings.update cloudaicompanion.repositoryGroups.create cloudaicompanion.repositoryGroups.delete cloudaicompanion.repositoryGroups.get cloudaicompanion.repositoryGroups.getIamPolicy cloudaicompanion.repositoryGroups.list cloudaicompanion.repositoryGroups.setIamPolicy cloudaicompanion.repositoryGroups.update cloudaicompanion.settingBindings.* cloudaicompanion.settingBindings.aiDevToolsSettingsCreate cloudaicompanion.settingBindings.aiDevToolsSettingsDelete cloudaicompanion.settingBindings.aiDevToolsSettingsGet cloudaicompanion.settingBindings.aiDevToolsSettingsList cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate cloudaicompanion.settingBindings.aiDevToolsSettingsUse cloudaicompanion.settingBindings.codeToolsSettingsCreate cloudaicompanion.settingBindings.codeToolsSettingsDelete cloudaicompanion.settingBindings.codeToolsSettingsGet cloudaicompanion.settingBindings.codeToolsSettingsList cloudaicompanion.settingBindings.codeToolsSettingsUpdate cloudaicompanion.settingBindings.codeToolsSettingsUse cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse cloudaicompanion.settingBindings.loggingSettingsCreate cloudaicompanion.settingBindings.loggingSettingsDelete cloudaicompanion.settingBindings.loggingSettingsGet cloudaicompanion.settingBindings.loggingSettingsList cloudaicompanion.settingBindings.loggingSettingsUpdate cloudaicompanion.settingBindings.loggingSettingsUse cloudaicompanion.settingBindings.releaseChannelSettingsCreate cloudaicompanion.settingBindings.releaseChannelSettingsDelete cloudaicompanion.settingBindings.releaseChannelSettingsGet cloudaicompanion.settingBindings.releaseChannelSettingsList cloudaicompanion.settingBindings.releaseChannelSettingsUpdate cloudaicompanion.settingBindings.releaseChannelSettingsUse cloudnotifications.activities.list cloudtrace.insights.* cloudtrace.insights.get cloudtrace.insights.list cloudtrace.stats.get cloudtrace.tasks.* cloudtrace.tasks.create cloudtrace.tasks.delete cloudtrace.tasks.get cloudtrace.tasks.list cloudtrace.traceScopes.* cloudtrace.traceScopes.create cloudtrace.traceScopes.delete cloudtrace.traceScopes.get cloudtrace.traceScopes.list cloudtrace.traceScopes.update cloudtrace.traces.get cloudtrace.traces.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list discoveryengine.accounts.create discoveryengine.aclConfigs.* discoveryengine.aclConfigs.get discoveryengine.aclConfigs.update discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.setIamPolicy discoveryengine.agents.update discoveryengine.alertPolicies.* discoveryengine.alertPolicies.create discoveryengine.alertPolicies.get discoveryengine.alertPolicies.update discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.* discoveryengine.assistants.assist discoveryengine.assistants.create discoveryengine.assistants.delete discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.assistants.update discoveryengine.audioOverviews.* discoveryengine.audioOverviews.create discoveryengine.audioOverviews.delete discoveryengine.audioOverviews.get discoveryengine.audioOverviews.getIceConfig discoveryengine.audioOverviews.sendSdpOffer discoveryengine.authorizations.* discoveryengine.authorizations.create discoveryengine.authorizations.delete discoveryengine.authorizations.get discoveryengine.authorizations.list discoveryengine.authorizations.storeUserAuthorization discoveryengine.authorizations.update discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.* discoveryengine.cannedQueries.create discoveryengine.cannedQueries.delete discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cannedQueries.update discoveryengine.cmekConfigs.* discoveryengine.cmekConfigs.delete discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.cmekConfigs.update discoveryengine.collections.* discoveryengine.collections.delete discoveryengine.collections.get discoveryengine.collections.getIamPolicy discoveryengine.collections.list discoveryengine.collections.setIamPolicy discoveryengine.completionConfigs.* discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.completionConfigs.update discoveryengine.completionSuggestions.* discoveryengine.completionSuggestions.import discoveryengine.completionSuggestions.purge discoveryengine.connectorRuns.* discoveryengine.connectorRuns.cancel discoveryengine.connectorRuns.list discoveryengine.controls.* discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.* discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataConnectors.startConnectorRun discoveryengine.dataConnectors.update discoveryengine.dataStores.* discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.getIamPolicy discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.setIamPolicy discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.devToolsConfigs.* discoveryengine.devToolsConfigs.get discoveryengine.devToolsConfigs.update discoveryengine.documentProcessingConfigs.* discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.* discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.* discoveryengine.engines.create discoveryengine.engines.createEngineUserData discoveryengine.engines.delete discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.setIamPolicy discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.* discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.licenseConfigs.* discoveryengine.licenseConfigs.create discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.licenseConfigs.update discoveryengine.locations.* discoveryengine.locations.completeExternalIdentities discoveryengine.locations.estimateDataSize discoveryengine.locations.exchangeAuthCredentials discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.locations.setUpDataConnector discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notebooks.* discoveryengine.notebooks.create discoveryengine.notebooks.generateGuide discoveryengine.notebooks.get discoveryengine.notebooks.getAnalytics discoveryengine.notebooks.getIamPolicy discoveryengine.notebooks.interactSources discoveryengine.notebooks.list discoveryengine.notebooks.removeSelf discoveryengine.notebooks.setIamPolicy discoveryengine.notebooks.update discoveryengine.notes.* discoveryengine.notes.create discoveryengine.notes.delete discoveryengine.notes.get discoveryengine.notes.update discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.* discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.projects.update discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.* discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.* discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.* discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.sitemaps.* discoveryengine.sitemaps.create discoveryengine.sitemaps.delete discoveryengine.sitemaps.fetch discoveryengine.sources.* discoveryengine.sources.checkFreshness discoveryengine.sources.create discoveryengine.sources.delete discoveryengine.sources.generateDocumentGuide discoveryengine.sources.get discoveryengine.sources.refresh discoveryengine.sources.update discoveryengine.suggestionDenyListEntries.* discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.* discoveryengine.targetSites.batchCreate discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.* discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.userStores.* discoveryengine.userStores.batchUpdateUserLicenses discoveryengine.userStores.get discoveryengine.userStores.listUserLicenses discoveryengine.userStores.update discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update logging.buckets.get logging.buckets.list logging.exclusions.get logging.exclusions.list logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.list logging.logMetrics.get logging.logMetrics.list logging.logScopes.get logging.logScopes.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.operations.get logging.operations.list logging.queries.getShared logging.queries.listShared logging.queries.usePrivate logging.sinks.get logging.sinks.list logging.usage.get logging.views.get logging.views.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list observability.scopes.get observability.traceScopes.* observability.traceScopes.create observability.traceScopes.delete observability.traceScopes.get observability.traceScopes.list observability.traceScopes.update opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list
Éditeur Discovery Engine (roles/discoveryengine.editor) Accorde un accès en lecture et en écriture à toutes les ressources Discovery Engine.	discoveryengine.aclConfigs.get discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.update discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.assist discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.authorizations.storeUserAuthorization discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.trainCustomModel discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.update discoveryengine.engines.createEngineUserData discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userStores.get discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Utilisateur Gemini Enterprise (roles/discoveryengine.agentspaceUser) Accorde un accès utilisateur aux ressources Gemini Enterprise.	businessaicode.* businessaicode.locations.fetchQuotaStatus businessaicode.locations.generateContent businessaicode.locations.queryConfiguration businessaicode.locations.selfAssignLicense businessaicode.locations.sendTelemetry cloudaicompanion.companions.* cloudaicompanion.companions.generateChat cloudaicompanion.companions.generateCode cloudaicompanion.entitlements.get cloudaicompanion.instances.* cloudaicompanion.instances.completeCode cloudaicompanion.instances.completeTask cloudaicompanion.instances.exportMetrics cloudaicompanion.instances.generateCode cloudaicompanion.instances.generateText cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.licenses.selfAssign cloudaicompanion.operations.get cloudaicompanion.topics.create discoveryengine.accounts.create discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.requestReview discoveryengine.agents.update discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.assist discoveryengine.authorizations.storeUserAuthorization discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.collections.get discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.removeSuggestion discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.devToolsConfigs.get discoveryengine.engines.createEngineUserData discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getPersonalContext discoveryengine.engines.updateEngineUserData discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.get geminicloudassist.agents.invoke resourcemanager.projects.get resourcemanager.projects.list
Utilisateur Gemini Enterprise restreint (roles/discoveryengine.agentspaceRestrictedUser) Accorde un accès utilisateur limité aux ressources Gemini Enterprise, pour un contrôle précis sur plusieurs instances Gemini Enterprise d'un même projet. Les comptes principaux disposant de ce rôle devront obtenir un rôle d'utilisateur non restreint (ex. /agentspaceUser) sur une stratégie Engine pour pouvoir utiliser Gemini Enterprise.	discoveryengine.accounts.create discoveryengine.authorizations.storeUserAuthorization discoveryengine.collections.get discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update resourcemanager.projects.get resourcemanager.projects.list
Lecteur Discovery Engine (roles/discoveryengine.viewer) Accorde un accès en lecture à toutes les ressources Discovery Engine.	discoveryengine.aclConfigs.get discoveryengine.agentFiles.list discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.get discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.models.get discoveryengine.models.list discoveryengine.notificationMessages.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.userStores.get discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list

Gérer l'IAM Gemini Enterprise

Vous pouvez obtenir et définir des stratégies d'autorisation IAM et des rôles IAM à l'aide de la console Google Cloud . Pour en savoir plus, consultez Gérer l'accès aux projets, aux dossiers et aux organisations.

Accorder des autorisations aux administrateurs

En tant que propriétaire d'un projet, vous pouvez attribuer les rôles Gemini Enterprise Admin, Service Usage Consumer et Logs Viewer aux utilisateurs qui souhaitent être administrateurs.

Pour ajouter les rôles, procédez comme suit :

1. Dans la console Google Cloud , accédez à la page IAM.

   Accéder à IAM
2. Sélectionnez le projet.
3. Cliquez sur  Accorder l'accès.

4. Dans le champ Nouveaux comptes principaux, saisissez l'identifiant utilisateur. Il s'agit généralement de l'adresse e-mail d'un compte Google ou d'un groupe d'utilisateurs.

5. Ajoutez les rôles :
1. Cliquez sur Ajouter un autre rôle.
2. Dans la liste Sélectionner un rôle, sélectionnez Administrateur Gemini Enterprise.
3. Répétez les étapes a et b pour ajouter les rôles Consommateur Service Usage et Visionneuse de journaux.
6. Cliquez sur Enregistrer.

Accorder des autorisations à vos utilisateurs

Cette section explique comment accorder à vos utilisateurs les rôles au niveau du projet dont ils ont besoin pour accéder aux applications Gemini Enterprise. Selon votre modèle d'accès, choisissez l'un des rôles suivants :

• Accéder à toutes les applications du projet : accordez le rôle Utilisateur Gemini Enterprise (roles/discoveryengine.agentspaceUser) au niveau du projet.
• Accès à des applications spécifiques uniquement : accordez le rôle Utilisateur restreint Gemini Enterprise (roles/discoveryengine.agentspaceRestrictedUser) au niveau du projet, puis accordez le rôle Utilisateur Gemini Enterprise (roles/discoveryengine.agentspaceUser) sur les applications individuelles. Le rôle d'utilisateur restreint n'accorde l'accès à aucune application en soi. Les utilisateurs ne peuvent donc ouvrir que les applications pour lesquelles vous leur accordez le rôle d'utilisateur Gemini Enterprise. Pour en savoir plus, consultez Configurer les contrôles d'accès pour les applications.

Pour accorder le rôle au niveau du projet dans la console Google Cloud , procédez comme suit :

1. Dans la console Google Cloud , accédez à la page IAM.

   Accéder à IAM
2. Sélectionnez le projet.
3. Cliquez sur  Accorder l'accès.

4. Dans le champ Nouveaux comptes principaux, saisissez l'identifiant utilisateur. Il s'agit généralement de l'adresse e-mail d'un compte Google ou d'un groupe d'utilisateurs, ou de l'identifiant d'un utilisateur dans un pool d'identités de personnel. Pour en savoir plus, consultez Identifiants de compte principal pour les règles d'autorisation.

5. Ajoutez le rôle au niveau du projet :

   1. Cliquez sur Ajouter un autre rôle.

   2. Dans la liste Sélectionner un rôle, sélectionnez l'un des rôles suivants :

      • Pour accorder l'accès à toutes les applications du projet, sélectionnez Utilisateur Gemini Enterprise.
      • Pour limiter l'accès à des applications spécifiques, sélectionnez Utilisateur restreint Gemini Enterprise.
6. Cliquez sur Enregistrer.

7. Si vous avez attribué le rôle Utilisateur Gemini Enterprise restreint, attribuez le rôle Utilisateur Gemini Enterprise (roles/discoveryengine.agentspaceUser) à chaque application à laquelle l'utilisateur doit accéder. Pour obtenir des instructions détaillées, consultez Configurer les contrôles d'accès pour les applications.

Remarque : En plus du rôle IAM, les utilisateurs ont besoin d'une licence Gemini Enterprise. Consultez Obtenir des licences pour Gemini Enterprise.

Pour permettre aux utilisateurs de gérer et de partager des applications, attribuez-leur le rôle Lecteur Discovery Engine (roles/discoveryengine.viewer).

Étapes suivantes

• Découvrez comment gérer l'accès aux projets, aux dossiers et aux organisations.
• Apprenez-en plus sur IAM.
• Apprenez-en plus sur les rôles de base.
• Découvrez les rôles personnalisés.