IAM-Rollen und -Berechtigungen

Auf dieser Seite wird beschrieben, wie Sie den API-Zugriff und Berechtigungen für Gemini Enterprise-Ressourcen mit Identity and Access Management (IAM) steuern können.

Übersicht

Google Cloud bietet IAM, mit dem Sie den Zugriff auf bestimmte Ressourcen von Google Cloud genauer steuern und unerwünschten Zugriff auf andere Ressourcen verhindern können. Auf dieser Seite werden die IAM-Rollen und ‑Berechtigungen für Gemini Enterprise beschrieben. Eine ausführliche Beschreibung vonGoogle Cloud IAM finden Sie in der IAM-Dokumentation.

Gemini Enterprise bietet eine Reihe vordefinierter Rollen, mit denen Sie den Zugriff auf Ihre Gemini Enterprise-Ressourcen steuern können. Sie können auch eigene benutzerdefinierte Rollen erstellen, wenn die vordefinierten Rollen keine Informationen zu den benötigten Gruppen von Berechtigungen enthalten. Zusätzlich stehen Ihnen die älteren einfachen Rollen (Bearbeiter, Betrachter und Inhaber) nach wie vor zur Verfügung. Sie bieten aber nicht die gleiche präzisen Steuerungsmöglichkeiten wie die Gemini Enterprise-Rollen. Insbesondere ermöglichen die einfachen Rollen Zugriff auf Ressourcen in der gesamten Google Cloud und nicht nur für Gemini Enterprise. Weitere Informationen finden Sie in der Dokumentation zu einfachen Rollen.

Vordefinierte Rollen

Gemini Enterprise bietet vordefinierte Rollen, mit denen Sie detailliertere Berechtigungen für Hauptkonten bereitstellen können. Die Rolle, die Sie einem Hauptkonto zuweisen, legt fest, welche Aktionen mit dem Hauptkonto ausgeführt werden können. Hauptkonten können Einzelpersonen, Gruppen oder Dienstkonten sein.

Sie können demselben Hauptkonto mehrere Rollen zuweisen und die einem Hauptkonto zugewiesenen Rollen jederzeit ändern, sofern Sie selbst die Berechtigungen dazu haben.

Die Rollen mit höheren Berechtigungen beinhalten die Rollen mit niedrigeren Berechtigungen. Die Rolle „Discovery Engine-Bearbeiter“ enthält beispielsweise alle Berechtigungen der Rolle „Discovery Engine-Betrachter“ sowie die zusätzlichen Berechtigungen der Rolle „Discovery Engine-Bearbeiter“. Die Rolle „Gemini Enterprise Admin“ umfasst alle Berechtigungen der Rolle „Discovery Engine Editor“ sowie die entsprechenden zusätzlichen Berechtigungen.

Die einfachen Rollen (Inhaber, Bearbeiter, Betrachter) stellen Berechtigungen für Google Cloudbereit. Die für Gemini Enterprise spezifischen Rollen bieten nur Gemini Enterprise-Berechtigungen, mit Ausnahme der folgenden Google Cloud-Berechtigungen, die für die allgemeine Google Cloud -Nutzung erforderlich sind:

• resourcemanager.projects.get
• resourcemanager.projects.list
• serviceusage.services.list
• serviceusage.services.get

In der folgenden Tabelle sind die Gemini Enterprise-IAM-Rollen und die jeweiligen Berechtigungen aufgeführt, die eine Rolle enthält.

Rolle	Berechtigungen
Gemini Enterprise Admin (roles/discoveryengine.agentspaceAdmin) Gewährt Zugriff auf Administratorebene auf Gemini Enterprise-Ressourcen.	cloudaicompanion.aiDevToolsSettings.* cloudaicompanion.aiDevToolsSettings.create cloudaicompanion.aiDevToolsSettings.delete cloudaicompanion.aiDevToolsSettings.get cloudaicompanion.aiDevToolsSettings.list cloudaicompanion.aiDevToolsSettings.update cloudaicompanion.codeRepositoryIndexes.* cloudaicompanion.codeRepositoryIndexes.create cloudaicompanion.codeRepositoryIndexes.delete cloudaicompanion.codeRepositoryIndexes.get cloudaicompanion.codeRepositoryIndexes.list cloudaicompanion.codeRepositoryIndexes.update cloudaicompanion.codeToolsSettings.* cloudaicompanion.codeToolsSettings.create cloudaicompanion.codeToolsSettings.delete cloudaicompanion.codeToolsSettings.get cloudaicompanion.codeToolsSettings.list cloudaicompanion.codeToolsSettings.update cloudaicompanion.dataSharingWithGoogleSettings.* cloudaicompanion.dataSharingWithGoogleSettings.create cloudaicompanion.dataSharingWithGoogleSettings.delete cloudaicompanion.dataSharingWithGoogleSettings.get cloudaicompanion.dataSharingWithGoogleSettings.list cloudaicompanion.dataSharingWithGoogleSettings.update cloudaicompanion.geminiGcpEnablementSettings.* cloudaicompanion.geminiGcpEnablementSettings.create cloudaicompanion.geminiGcpEnablementSettings.delete cloudaicompanion.geminiGcpEnablementSettings.get cloudaicompanion.geminiGcpEnablementSettings.list cloudaicompanion.geminiGcpEnablementSettings.update cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.loggingSettings.* cloudaicompanion.loggingSettings.create cloudaicompanion.loggingSettings.delete cloudaicompanion.loggingSettings.get cloudaicompanion.loggingSettings.list cloudaicompanion.loggingSettings.update cloudaicompanion.operations.* cloudaicompanion.operations.cancel cloudaicompanion.operations.delete cloudaicompanion.operations.get cloudaicompanion.operations.list cloudaicompanion.releaseChannelSettings.* cloudaicompanion.releaseChannelSettings.create cloudaicompanion.releaseChannelSettings.delete cloudaicompanion.releaseChannelSettings.get cloudaicompanion.releaseChannelSettings.list cloudaicompanion.releaseChannelSettings.update cloudaicompanion.repositoryGroups.create cloudaicompanion.repositoryGroups.delete cloudaicompanion.repositoryGroups.get cloudaicompanion.repositoryGroups.getIamPolicy cloudaicompanion.repositoryGroups.list cloudaicompanion.repositoryGroups.setIamPolicy cloudaicompanion.repositoryGroups.update cloudaicompanion.settingBindings.* cloudaicompanion.settingBindings.aiDevToolsSettingsCreate cloudaicompanion.settingBindings.aiDevToolsSettingsDelete cloudaicompanion.settingBindings.aiDevToolsSettingsGet cloudaicompanion.settingBindings.aiDevToolsSettingsList cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate cloudaicompanion.settingBindings.aiDevToolsSettingsUse cloudaicompanion.settingBindings.codeToolsSettingsCreate cloudaicompanion.settingBindings.codeToolsSettingsDelete cloudaicompanion.settingBindings.codeToolsSettingsGet cloudaicompanion.settingBindings.codeToolsSettingsList cloudaicompanion.settingBindings.codeToolsSettingsUpdate cloudaicompanion.settingBindings.codeToolsSettingsUse cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse cloudaicompanion.settingBindings.loggingSettingsCreate cloudaicompanion.settingBindings.loggingSettingsDelete cloudaicompanion.settingBindings.loggingSettingsGet cloudaicompanion.settingBindings.loggingSettingsList cloudaicompanion.settingBindings.loggingSettingsUpdate cloudaicompanion.settingBindings.loggingSettingsUse cloudaicompanion.settingBindings.releaseChannelSettingsCreate cloudaicompanion.settingBindings.releaseChannelSettingsDelete cloudaicompanion.settingBindings.releaseChannelSettingsGet cloudaicompanion.settingBindings.releaseChannelSettingsList cloudaicompanion.settingBindings.releaseChannelSettingsUpdate cloudaicompanion.settingBindings.releaseChannelSettingsUse cloudnotifications.activities.list cloudtrace.insights.* cloudtrace.insights.get cloudtrace.insights.list cloudtrace.stats.get cloudtrace.tasks.* cloudtrace.tasks.create cloudtrace.tasks.delete cloudtrace.tasks.get cloudtrace.tasks.list cloudtrace.traceScopes.* cloudtrace.traceScopes.create cloudtrace.traceScopes.delete cloudtrace.traceScopes.get cloudtrace.traceScopes.list cloudtrace.traceScopes.update cloudtrace.traces.get cloudtrace.traces.list consumerprocurement.entitlements.* consumerprocurement.entitlements.get consumerprocurement.entitlements.list discoveryengine.accounts.create discoveryengine.aclConfigs.* discoveryengine.aclConfigs.get discoveryengine.aclConfigs.update discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.setIamPolicy discoveryengine.agents.update discoveryengine.alertPolicies.* discoveryengine.alertPolicies.create discoveryengine.alertPolicies.get discoveryengine.alertPolicies.update discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.* discoveryengine.assistants.assist discoveryengine.assistants.create discoveryengine.assistants.delete discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.assistants.update discoveryengine.audioOverviews.* discoveryengine.audioOverviews.create discoveryengine.audioOverviews.delete discoveryengine.audioOverviews.get discoveryengine.audioOverviews.getIceConfig discoveryengine.audioOverviews.sendSdpOffer discoveryengine.authorizations.* discoveryengine.authorizations.create discoveryengine.authorizations.delete discoveryengine.authorizations.get discoveryengine.authorizations.list discoveryengine.authorizations.storeUserAuthorization discoveryengine.authorizations.update discoveryengine.billingAccountLicenseConfigs.* discoveryengine.billingAccountLicenseConfigs.distribute discoveryengine.billingAccountLicenseConfigs.get discoveryengine.billingAccountLicenseConfigs.list discoveryengine.billingAccountLicenseConfigs.retract discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.* discoveryengine.cannedQueries.create discoveryengine.cannedQueries.delete discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cannedQueries.update discoveryengine.cmekConfigs.* discoveryengine.cmekConfigs.delete discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.cmekConfigs.update discoveryengine.collections.* discoveryengine.collections.delete discoveryengine.collections.get discoveryengine.collections.getIamPolicy discoveryengine.collections.list discoveryengine.collections.setIamPolicy discoveryengine.completionConfigs.* discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.completionConfigs.update discoveryengine.completionSuggestions.* discoveryengine.completionSuggestions.import discoveryengine.completionSuggestions.purge discoveryengine.connectorRuns.* discoveryengine.connectorRuns.cancel discoveryengine.connectorRuns.list discoveryengine.controls.* discoveryengine.controls.create discoveryengine.controls.delete discoveryengine.controls.get discoveryengine.controls.list discoveryengine.controls.update discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.* discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataConnectors.startConnectorRun discoveryengine.dataConnectors.update discoveryengine.dataStores.* discoveryengine.dataStores.completeQuery discoveryengine.dataStores.create discoveryengine.dataStores.delete discoveryengine.dataStores.enrollSolutions discoveryengine.dataStores.get discoveryengine.dataStores.getIamPolicy discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.setIamPolicy discoveryengine.dataStores.trainCustomModel discoveryengine.dataStores.update discoveryengine.devToolsConfigs.* discoveryengine.devToolsConfigs.get discoveryengine.devToolsConfigs.update discoveryengine.documentProcessingConfigs.* discoveryengine.documentProcessingConfigs.get discoveryengine.documentProcessingConfigs.update discoveryengine.documents.* discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.purge discoveryengine.documents.update discoveryengine.engines.* discoveryengine.engines.create discoveryengine.engines.createEngineUserData discoveryengine.engines.delete discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getIamPolicy discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.setIamPolicy discoveryengine.engines.tune discoveryengine.engines.update discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.* discoveryengine.evaluations.create discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.licenseConfigs.* discoveryengine.licenseConfigs.create discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.licenseConfigs.update discoveryengine.locations.* discoveryengine.locations.completeExternalIdentities discoveryengine.locations.estimateDataSize discoveryengine.locations.exchangeAuthCredentials discoveryengine.locations.fetchAgentCards discoveryengine.locations.getConnectorSource discoveryengine.locations.listConnectorSources discoveryengine.locations.setUpDataConnector discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notebooks.* discoveryengine.notebooks.create discoveryengine.notebooks.generateGuide discoveryengine.notebooks.get discoveryengine.notebooks.getAnalytics discoveryengine.notebooks.getIamPolicy discoveryengine.notebooks.interactSources discoveryengine.notebooks.list discoveryengine.notebooks.removeSelf discoveryengine.notebooks.setIamPolicy discoveryengine.notebooks.update discoveryengine.notes.* discoveryengine.notes.create discoveryengine.notes.delete discoveryengine.notes.get discoveryengine.notes.update discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.* discoveryengine.projects.get discoveryengine.projects.provision discoveryengine.projects.reportConsentChange discoveryengine.projects.update discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.* discoveryengine.schemas.create discoveryengine.schemas.delete discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.update discoveryengine.schemas.validate discoveryengine.servingConfigs.* discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.create discoveryengine.servingConfigs.delete discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.servingConfigs.update discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.* discoveryengine.siteSearchEngines.batchVerifyTargetSites discoveryengine.siteSearchEngines.disableAdvancedSiteSearch discoveryengine.siteSearchEngines.enableAdvancedSiteSearch discoveryengine.siteSearchEngines.fetchDomainVerificationStatus discoveryengine.siteSearchEngines.get discoveryengine.siteSearchEngines.recrawlUris discoveryengine.sitemaps.* discoveryengine.sitemaps.create discoveryengine.sitemaps.delete discoveryengine.sitemaps.fetch discoveryengine.sources.* discoveryengine.sources.checkFreshness discoveryengine.sources.create discoveryengine.sources.delete discoveryengine.sources.generateDocumentGuide discoveryengine.sources.get discoveryengine.sources.refresh discoveryengine.sources.update discoveryengine.suggestionDenyListEntries.* discoveryengine.suggestionDenyListEntries.import discoveryengine.suggestionDenyListEntries.purge discoveryengine.targetSites.* discoveryengine.targetSites.batchCreate discoveryengine.targetSites.create discoveryengine.targetSites.delete discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.targetSites.update discoveryengine.userEvents.* discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userEvents.purge discoveryengine.userStores.* discoveryengine.userStores.batchUpdateUserLicenses discoveryengine.userStores.get discoveryengine.userStores.listUserLicenses discoveryengine.userStores.update discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update logging.buckets.get logging.buckets.list logging.exclusions.get logging.exclusions.list logging.links.get logging.links.list logging.locations.* logging.locations.get logging.locations.list logging.logEntries.list logging.logMetrics.get logging.logMetrics.list logging.logScopes.get logging.logScopes.list logging.logServiceIndexes.list logging.logServices.list logging.logs.list logging.operations.get logging.operations.list logging.queries.getShared logging.queries.listShared logging.queries.usePrivate logging.sinks.get logging.sinks.list logging.usage.get logging.views.get logging.views.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.listEffectiveTags monitoring.alertPolicies.listTagBindings monitoring.alerts.* monitoring.alerts.get monitoring.alerts.list monitoring.dashboards.get monitoring.dashboards.list monitoring.dashboards.listEffectiveTags monitoring.dashboards.listTagBindings monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.notificationChannelDescriptors.* monitoring.notificationChannelDescriptors.get monitoring.notificationChannelDescriptors.list monitoring.notificationChannels.get monitoring.notificationChannels.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.uptimeCheckConfigs.get monitoring.uptimeCheckConfigs.list observability.scopes.get observability.traceScopes.* observability.traceScopes.create observability.traceScopes.delete observability.traceScopes.get observability.traceScopes.list observability.traceScopes.update opsconfigmonitoring.resourceMetadata.list resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list
Discovery Engine-Bearbeiter (roles/discoveryengine.editor) Gewährt Lese- und Schreibzugriff auf alle Discovery Engine-Ressourcen.	discoveryengine.aclConfigs.get discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.manage discoveryengine.agents.update discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.assist discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.authorizations.storeUserAuthorization discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.completionConfigs.removeSuggestion discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.* discoveryengine.conversations.converse discoveryengine.conversations.create discoveryengine.conversations.delete discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.conversations.update discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.dataStores.trainCustomModel discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.create discoveryengine.documents.delete discoveryengine.documents.get discoveryengine.documents.import discoveryengine.documents.list discoveryengine.documents.update discoveryengine.engines.createEngineUserData discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.engines.pause discoveryengine.engines.resume discoveryengine.engines.tune discoveryengine.engines.updateEngineUserData discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.identityMappingStores.* discoveryengine.identityMappingStores.create discoveryengine.identityMappingStores.delete discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.importIdentityMappings discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.identityMappingStores.purgeIdentityMappings discoveryengine.licenseConfigs.get discoveryengine.licenseConfigs.list discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.models.* discoveryengine.models.create discoveryengine.models.delete discoveryengine.models.get discoveryengine.models.list discoveryengine.models.pause discoveryengine.models.resume discoveryengine.models.tune discoveryengine.models.update discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.* discoveryengine.sampleQueries.create discoveryengine.sampleQueries.delete discoveryengine.sampleQueries.get discoveryengine.sampleQueries.import discoveryengine.sampleQueries.list discoveryengine.sampleQueries.update discoveryengine.sampleQuerySets.* discoveryengine.sampleQuerySets.create discoveryengine.sampleQuerySets.delete discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.sampleQuerySets.update discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.create discoveryengine.userEvents.fetchStats discoveryengine.userEvents.import discoveryengine.userStores.get discoveryengine.widgetConfigs.* discoveryengine.widgetConfigs.get discoveryengine.widgetConfigs.update resourcemanager.projects.get resourcemanager.projects.list
Gemini Enterprise User (roles/discoveryengine.agentspaceUser) Gewährt Zugriff auf Nutzerebene auf Gemini Enterprise-Ressourcen.	businessaicode.* businessaicode.locations.fetchQuotaStatus businessaicode.locations.generateContent businessaicode.locations.queryConfiguration businessaicode.locations.selfAssignLicense businessaicode.locations.sendTelemetry cloudaicompanion.companions.* cloudaicompanion.companions.generateChat cloudaicompanion.companions.generateCode cloudaicompanion.entitlements.get cloudaicompanion.instances.* cloudaicompanion.instances.completeCode cloudaicompanion.instances.completeTask cloudaicompanion.instances.exportMetrics cloudaicompanion.instances.generateCode cloudaicompanion.instances.generateText cloudaicompanion.instances.queryEffectiveSetting cloudaicompanion.instances.queryEffectiveSettingBindings cloudaicompanion.licenses.selfAssign cloudaicompanion.operations.get cloudaicompanion.topics.create discoveryengine.accounts.create discoveryengine.agentFiles.* discoveryengine.agentFiles.delete discoveryengine.agentFiles.download discoveryengine.agentFiles.import discoveryengine.agentFiles.list discoveryengine.agentFiles.upload discoveryengine.agentIamProposals.* discoveryengine.agentIamProposals.create discoveryengine.agentIamProposals.delete discoveryengine.agentIamProposals.get discoveryengine.agentIamProposals.list discoveryengine.agents.create discoveryengine.agents.delete discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.agents.requestReview discoveryengine.agents.update discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.assist discoveryengine.authorizations.storeUserAuthorization discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.collections.get discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.removeSuggestion discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.devToolsConfigs.get discoveryengine.engines.createEngineUserData discoveryengine.engines.generateMemories discoveryengine.engines.generatePersonalContext discoveryengine.engines.get discoveryengine.engines.getEngineUserData discoveryengine.engines.getPersonalContext discoveryengine.engines.updateEngineUserData discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.* discoveryengine.ideaForgeIdeas.create discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.* discoveryengine.ideaForgeInstances.get discoveryengine.ideaForgeInstances.start discoveryengine.ideaForgeInstances.stop discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.* discoveryengine.memories.delete discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.memories.update discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.notificationMessages.* discoveryengine.notificationMessages.ackAll discoveryengine.notificationMessages.list discoveryengine.notificationMessages.update discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.* discoveryengine.sessions.addContextFile discoveryengine.sessions.create discoveryengine.sessions.delete discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sessions.removeContextFile discoveryengine.sessions.search discoveryengine.sessions.selectContextFiles discoveryengine.sessions.update discoveryengine.sessions.uploadFile discoveryengine.sharedContents.* discoveryengine.sharedContents.create discoveryengine.sharedContents.delete discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update discoveryengine.widgetConfigs.get geminicloudassist.agents.invoke resourcemanager.projects.get resourcemanager.projects.list
Gemini Enterprise Restricted User (roles/discoveryengine.agentspaceRestrictedUser) Gewährt eingeschränkten Zugriff auf Nutzerebene auf Gemini Enterprise-Ressourcen, um mehrere Gemini Enterprise-Instanzen im selben Projekt genau zu steuern. Hauptkonten mit dieser Rolle benötigen eine uneingeschränkte Nutzerrolle (z. B. /agentspaceUser) für eine Engine-Richtlinie, um Gemini Enterprise verwenden zu können.	discoveryengine.accounts.create discoveryengine.authorizations.storeUserAuthorization discoveryengine.collections.get discoveryengine.dataConnectors.acquireAccessToken discoveryengine.dataConnectors.acquireAndStoreRefreshToken discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.executeAction discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.get discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.notebooks.create discoveryengine.notebooks.list discoveryengine.userEvents.create discoveryengine.users.* discoveryengine.users.get discoveryengine.users.update resourcemanager.projects.get resourcemanager.projects.list
Discovery Engine-Betrachter (roles/discoveryengine.viewer) Gewährt Lesezugriff auf alle Discovery Engine-Ressourcen.	discoveryengine.aclConfigs.get discoveryengine.agentFiles.list discoveryengine.agents.get discoveryengine.agents.getAgentView discoveryengine.agents.getIamPolicy discoveryengine.agents.list discoveryengine.agents.listAvailableAgentViews discoveryengine.alertPolicies.get discoveryengine.analytics.* discoveryengine.analytics.acquireDashboardSession discoveryengine.analytics.refreshDashboardSessionTokens discoveryengine.answers.get discoveryengine.assistAnswers.get discoveryengine.assistants.get discoveryengine.assistants.list discoveryengine.branches.* discoveryengine.branches.get discoveryengine.branches.list discoveryengine.cannedQueries.get discoveryengine.cannedQueries.list discoveryengine.cannedQueries.listActiveCannedQueryUserViews discoveryengine.cmekConfigs.get discoveryengine.cmekConfigs.list discoveryengine.collections.get discoveryengine.collections.list discoveryengine.completionConfigs.completeQuery discoveryengine.completionConfigs.get discoveryengine.connectorRuns.list discoveryengine.controls.get discoveryengine.controls.list discoveryengine.conversations.converse discoveryengine.conversations.get discoveryengine.conversations.list discoveryengine.dataConnectors.buildActionInvocation discoveryengine.dataConnectors.checkRefreshToken discoveryengine.dataConnectors.get discoveryengine.dataConnectors.queryAvailableActions discoveryengine.dataStores.completeQuery discoveryengine.dataStores.get discoveryengine.dataStores.list discoveryengine.dataStores.listCustomModels discoveryengine.devToolsConfigs.get discoveryengine.documentProcessingConfigs.get discoveryengine.documents.batchGetDocumentsMetadata discoveryengine.documents.get discoveryengine.documents.list discoveryengine.engines.get discoveryengine.engines.getPersonalContext discoveryengine.engines.list discoveryengine.evaluations.get discoveryengine.evaluations.list discoveryengine.groundingConfigs.check discoveryengine.homepageDataConfigs.fetchDocuments discoveryengine.ideaForgeIdeas.get discoveryengine.ideaForgeInstances.get discoveryengine.identityMappingStores.get discoveryengine.identityMappingStores.list discoveryengine.identityMappingStores.listIdentityMappings discoveryengine.locations.completeExternalIdentities discoveryengine.locations.fetchAgentCards discoveryengine.memories.list discoveryengine.memories.retrieve discoveryengine.models.get discoveryengine.models.list discoveryengine.notificationMessages.list discoveryengine.operations.* discoveryengine.operations.get discoveryengine.operations.list discoveryengine.projectOverageConfigs.get discoveryengine.projects.get discoveryengine.rankingConfigs.rank discoveryengine.sampleQueries.get discoveryengine.sampleQueries.list discoveryengine.sampleQuerySets.get discoveryengine.sampleQuerySets.list discoveryengine.schemas.get discoveryengine.schemas.list discoveryengine.schemas.preview discoveryengine.schemas.validate discoveryengine.servingConfigs.answer discoveryengine.servingConfigs.get discoveryengine.servingConfigs.list discoveryengine.servingConfigs.recommend discoveryengine.servingConfigs.search discoveryengine.sessions.downloadFile discoveryengine.sessions.generateSummary discoveryengine.sessions.get discoveryengine.sessions.list discoveryengine.sessions.listSessionFileMetadata discoveryengine.sessions.recommendQuestions discoveryengine.sharedContents.get discoveryengine.sharedContents.list discoveryengine.siteSearchEngines.get discoveryengine.targetSites.get discoveryengine.targetSites.list discoveryengine.userEvents.fetchStats discoveryengine.userStores.get discoveryengine.widgetConfigs.get resourcemanager.projects.get resourcemanager.projects.list

IAM für Gemini Enterprise verwalten

Sie können IAM-Allow-Richtlinien und IAM-Rollen mit der Google Cloud Console abrufen und festlegen. Weitere Informationen finden Sie unter Zugriff auf Projekte, Ordner und Organisationen verwalten.

Administratoren Berechtigungen erteilen

Als Projektinhaber können Sie Nutzern, die Administratoren sein sollen, die Rollen Gemini Enterprise Admin, Service Usage Consumer und Logs Viewer zuweisen.

So fügen Sie die Rollen hinzu:

1. Rufen Sie in der Google Cloud Console die Seite IAM auf.

   IAM aufrufen
2. Wählen Sie das Projekt aus.
3. Klicken Sie auf Zugriffsrechte erteilen.

4. Geben Sie im Feld Neue Hauptkonten die Nutzer-ID ein. Dies ist in der Regel die E‑Mail-Adresse eines Google-Kontos oder einer Nutzergruppe.

5. Fügen Sie die Rollen hinzu:
1. Klicken Sie auf Weitere Rolle hinzufügen.
2. Wählen Sie in der Liste Rolle auswählen die Option Gemini Enterprise-Administrator aus.
3. Wiederholen Sie die Schritte a und b, um die Rollen Service Usage Consumer und Loganzeige hinzuzufügen.
6. Klicken Sie auf Speichern.

Nutzern Berechtigungen erteilen

In diesem Abschnitt wird beschrieben, wie Sie Ihren Nutzern die Rollen auf Projektebene zuweisen, die sie für den Zugriff auf Gemini Enterprise-Apps benötigen. Wählen Sie je nach Zugriffsmodell eine der folgenden Rollen aus:

• Auf alle Apps im Projekt zugreifen: Weisen Sie die Rolle Gemini Enterprise User (roles/discoveryengine.agentspaceUser) auf Projektebene zu.
• Nur auf bestimmte Apps zugreifen: Weisen Sie die Rolle Gemini Enterprise Restricted User (roles/discoveryengine.agentspaceRestrictedUser) auf Projektebene zu und dann die Rolle Gemini Enterprise User (roles/discoveryengine.agentspaceUser) für die einzelnen Apps. Die Rolle „Eingeschränkter Nutzer“ gewährt keinen Zugriff auf Apps. Nutzer können also nur die Apps öffnen, für die Sie ihnen die Rolle „Gemini Enterprise-Nutzer“ zuweisen. Weitere Informationen finden Sie unter Zugriffssteuerung für Apps konfigurieren.

So weisen Sie die Rolle auf Projektebene in der Google Cloud -Console zu:

1. Rufen Sie in der Google Cloud Console die Seite IAM auf.

   IAM aufrufen
2. Wählen Sie das Projekt aus.
3. Klicken Sie auf Zugriffsrechte erteilen.

4. Geben Sie im Feld Neue Hauptkonten die Nutzer-ID ein. Dies ist in der Regel die E-Mail-Adresse für ein Google-Konto, eine Nutzergruppe oder die Kennung für einen Nutzer in einem Mitarbeiteridentitätspool. Weitere Informationen finden Sie unter Hauptkontokennungen für Zulassungsrichtlinien.

5. Fügen Sie die Rolle auf Projektebene hinzu:

   1. Klicken Sie auf Weitere Rolle hinzufügen.

   2. Wählen Sie in der Liste Rolle auswählen eine der folgenden Rollen aus:

      • Wenn Sie Zugriff auf alle Apps im Projekt gewähren möchten, wählen Sie Gemini Enterprise-Nutzer aus.
      • Wenn Sie den Zugriff auf bestimmte Apps einschränken möchten, wählen Sie Gemini Enterprise Restricted User aus.
6. Klicken Sie auf Speichern.

7. Wenn Sie die Rolle Gemini Enterprise Restricted User zugewiesen haben, weisen Sie die Rolle Gemini Enterprise User (roles/discoveryengine.agentspaceUser) für jede einzelne App zu, auf die der Nutzer zugreifen muss. Eine detaillierte Anleitung finden Sie unter Zugriffssteuerung für Apps konfigurieren.

Hinweis :Zusätzlich zur IAM-Rolle benötigen Nutzer eine Lizenz für Gemini Enterprise. Weitere Informationen finden Sie unter Lizenzen für Gemini Enterprise erwerben.

Wenn Sie Nutzern erlauben möchten, Apps zu verwalten und freizugeben, weisen Sie ihnen die Rolle Discovery Engine-Betrachter (roles/discoveryengine.viewer) zu.

Nächste Schritte

• Zugriff auf Projekte, Ordner und Organisationen verwalten
• Mehr über IAM erfahren
• Mehr über einfache Rollen erfahren
• Benutzerdefinierte Rollen