This page describes how you can control API access and permissions for Gemini Enterprise resources using Identity and Access Management (IAM).
Overview
Google Cloud offers IAM, which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This page describes the Gemini Enterprise IAM roles and permissions. For a detailed description of Google Cloud IAM, see the IAM documentation.
Gemini Enterprise provides a set of predefined roles designed to help you control access to your Gemini Enterprise resources. You can also create your own custom roles, if the predefined roles don't provide the sets of permissions you need. In addition, the older basic roles (Editor, Viewer, and Owner) are also still available to you, although they don't provide the same fine-grained control as the Gemini Enterprise roles. In particular, the basic roles provide access to resources across Google Cloud rather than just for Gemini Enterprise. See the basic roles documentation for more information.
Predefined roles
Gemini Enterprise provides some predefined roles that you can use to provide finer-grained permissions to principals. The role you grant to a principal controls what actions the principal can take. Principals can be individuals, groups, or service accounts.
You can grant multiple roles to the same principal, and you can change the roles granted to a principal at any time, provided you have the permissions to do so.
The broader roles include the more narrowly defined roles. For example, the Discovery Engine Editor role includes all of the permissions of the Discovery Engine Viewer role, along with the addition permissions of the Discovery Engine Editor role. Likewise, the Gemini Enterprise Admin role includes all of the permissions of the Discovery Engine Editor role, along with its additional permissions.
The basic roles (Owner, Editor, Viewer) provide permissions across Google Cloud. The roles specific to Gemini Enterprise provide only Gemini Enterprise permissions, except for the following Google Cloud permissions, which are needed for general Google Cloud usage:
resourcemanager.projects.getresourcemanager.projects.listserviceusage.services.listserviceusage.services.get
The following table lists the Gemini Enterprise IAM roles with a corresponding list of all the permissions for each role.
| Role | Permissions |
|---|---|
Gemini Enterprise Admin( Grants admin-level access to Gemini Enterprise resources. |
|
Discovery Engine Editor( Grants read and write access to all discovery engine resources. |
|
Gemini Enterprise User( Grants user-level access to Gemini Enterprise resources. |
|
Gemini Enterprise Restricted User( Grants restricted user-level access to Gemini Enterprise resources, for fine-grained control over multiple Gemini Enterprise instances in the same project. Principals with this role will need to be granted an unrestricted user-level role (e.g. /agentspaceUser) on an Engine policy in order to use Gemini Enterprise. |
|
Discovery Engine Viewer( Grants read access to all discovery engine resources. |
|
Manage Gemini Enterprise IAM
You can get and set IAM allow policies and IAM roles using the Google Cloud Console. For more information, see Manage access to projects, folders, and organizations.
Grant permissions to admins
As a project owner, you can grant the Gemini Enterprise Admin,
Service Usage Consumer, and Logs Viewer roles to the users who want to be
administrators.
Follow these steps to add the roles:
-
In the Google Cloud console, go to the IAM page.
Go to IAM - Select the project.
- Click Grant access.
-
In the New principals field, enter the user identifier. This is typically the email address for a Google Account or a user group.
- Add the roles:
- Click Add another role.
- In the Select a role list, select Gemini Enterprise Admin.
- Repeat the steps a and b to add the Service usage consumer and Logs viewer roles.
- Click Save.
Grant permissions to your users
This section describes how to grant your users the project-level roles that they need to access Gemini Enterprise apps. Depending on your access model, choose one of the following roles:
- Access all apps in the project: Grant the Gemini Enterprise
User
(
roles/discoveryengine.agentspaceUser) role at the project level. - Access specific apps only: Grant the Gemini Enterprise Restricted
User
(
roles/discoveryengine.agentspaceRestrictedUser) role at the project level, and then grant the Gemini Enterprise User (roles/discoveryengine.agentspaceUser) role on the individual apps. The Restricted User role doesn't grant access to any app on its own, so users can open only the apps where you grant them the Gemini Enterprise User role. For more information, see Configure access controls for apps.
To grant the project-level role in the Google Cloud console, follow these steps:
-
In the Google Cloud console, go to the IAM page.
Go to IAM - Select the project.
- Click Grant access.
-
In the New principals field, enter the user identifier. This is typically the email address for a Google Account, a user group, or the identifier for a user in a workforce identity pool. For details, see Principal identifiers for allow policies.
-
Add the project-level role:
- Click Add another role.
-
In the Select a role list, select one of the following roles:
- To grant access across all apps in the project, select Gemini Enterprise User.
- To restrict access to specific apps, select Gemini Enterprise Restricted User.
- Click Save.
-
If you granted the Gemini Enterprise Restricted User role, grant the Gemini Enterprise User (
roles/discoveryengine.agentspaceUser) role on each individual app that the user needs to access. For step-by-step instructions, see Configure access controls for apps.
To allow users to manage and share apps, grant them the
Discovery Engine
Viewer
(roles/discoveryengine.viewer) role.
What's next
- Learn how to manage access to projects, folders, and organizations.
- Learn more about IAM.
- Learn more about basic roles.
- Learn more about custom roles.