Configure cross-project ADK agent access

This page explains how administrators can grant permission for Gemini Enterprise to access an ADK agent that runs within Vertex AI Agent Engine in a different Google Cloud project.

Identify the Gemini Enterprise service agent

To find the service agent email address for your Gemini Enterprise app project:

  1. In the Google Cloud console, go to the project that contains your Gemini Enterprise app.
  2. From the project list, find the project number.

  3. Construct the service agent email address using the following format:

    service-PROJECT_NUMBER@gcp-sa-discoveryengine.iam.gserviceaccount.com

    Replace PROJECT_NUMBER with the project number from the previous step.

Grant permissions in the agent project

Grant the Gemini Enterprise service agent permissions in the project where the ADK agent is hosted with Vertex AI Agent Engine:

  1. In the Google Cloud console, go to the project where the ADK agent is hosted with Vertex AI Agent Engine.
  2. Go to IAM & Admin > IAM.
  3. Click Grant Access.
  4. In the New principals field, enter the service agent email address that you identified in the previous section.
  5. In the Select a role list, search for and select Discovery Engine Service Agent (roles/discoveryengine.serviceAgent).
  6. Click Save.

What's next

  • After granting these permissions, you can Register the ADK agent in your Gemini Enterprise app, using the agent's resource path from the agent project.