Create a custom role to restrict access to AI developer tools

Default roles often provide broad access. To restrict access to AI developer tools and better align permissions with your organization's security policies, create custom roles. This guide shows you how to create and assign a custom IAM role for Gemini Enterprise's AI developer tools in the Google Cloud console.

When AI developer tools are enabled, users with a Gemini Enterprise license can access these tools if you grant them the Gemini Enterprise User (roles/discoveryengine.agentspaceUser) role.

Create a custom IAM role

To create a custom IAM role that restricts access to AI developer tools, follow these instructions:

  1. In the Google Cloud console, go to IAM & Admin > Roles.
  2. Click Create role.

  3. Enter the role details:

    • Title: Give your role a name. For example, Custom Gemini Enterprise User.
    • ID: The Google Cloud console automatically generates the ID, but you can edit it.
    • Role launch stage: Set this to "General Availability".

  4. Click Add permissions.

  5. In the panel, search for and select the Gemini Enterprise User (roles/discoveryengine.agentspaceUser) role.

  6. Remove all permissions starting with businessaicode. from the Gemini Enterprise User role to ensure users assigned this custom role can't access the AI developer tools feature.

  7. Click Create.

Add users to the custom role

To add users to the custom role you created, follow these steps:

  1. In the Google Cloud console, go to IAM & Admin > IAM.
  2. Click the Grant access button at the top of the page.
  3. In the New principals field, enter the email addresses of the users or groups you want to add.
  4. Assign the role:
    • Click Assign roles and search for the Title of the custom role you created in the previous section.
    • Select the role.
  5. Click Save.