Share custom agents

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page explains how you can share the Agent-to-Agent (A2A), Agent Development Kit (ADK), Dialogflow agents that you registered with Gemini Enterprise, and agents added from Google Cloud Marketplace. The A2A agents that you added from Google Cloud Marketplace are also explained so that users know how to access these agents from the Gemini Enterprise web app.

Before you begin

Before you can share an agent, you must meet the following requirements:

1. You must have an existing Gemini Enterprise web app. To create a new app, see Create an app.

2. You must have registered or added the custom agents to Gemini Enterprise using any of the following options:

   • Register and manage A2A agents
   • Register and manage ADK agents hosted on Vertex AI Agent Engine
   • Add and manage A2A agents from Google Cloud Marketplace
   • Register and manage Dialogflow agents

Share a custom agent with users

You can control who has access to a custom agent registered with Gemini Enterprise.

To share an agent, follow these steps:

1. In the Google Cloud console, go to the Gemini Enterprise page.

   Go to Gemini Enterprise

2. Select your project.

3. Click your app from the Name column. The navigation menu updates.

4. Click Agents from the navigation menu.

5. Click the Display name of the agent that you want to share.

6. Click the User permissions tab, and the Permissioned users page displays.

7. Click Add user. The Add user permissions roles to agent dialog displays.

8. Configure the permission details:

   1. Select one of the following options in the Member type section:

      • User: An individual end user. For this member type to function, you must include the correct IAM role. For more information, see IAM roles and permissions.

      • Group: A collection of end users. For this member type to function, you must include the correct IAM role. For more information, see IAM roles and permissions.

      • Principal set: All identities in a workload identity pool group, which includes external groups that aren't managed by Google.

      • All users: All users in the organization.

   2. Enter the unique member identification, and select a role:

      Member type	Description
      User	Enter email addresses in the Member field. Select a role in the Assign role field.
      Group	Enter email addresses in the Member field. Select a role in the Assign role field.
      Workforce identity pool	Enter Principal identifier in the Member field. Select a role in the Assign role field. For examples of principal sets, see Principal sets.
      All users	Select a role in the Assign role field.

9. Click Save.

Principal sets

The following are examples of principal sets that you can specify for the Workforce identity pool member type:

Principal set	Description
principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID	All workforce identities in a group.
principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/attribute.ATTRIBUTE_NAME/ATTRIBUTE_VALUE	All workforce identities with a specific attribute value.
principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/*	All identities in a workforce identity pool.
principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/group/GROUP_ID	A workload identity pool group.
principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.ATTRIBUTE_NAME/ATTRIBUTE_VALUE	All identities in a workload identity pool with a certain attribute.
principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*	All identities in a workload identity pool.

Replace the following placeholders with values in the code sample:

• PROJECT_NUMBER: the number used in the resource path to identify a specific Google Cloud project.
• GROUP_ID: a specific group identifier from an external Identity Provider (IdP), letting you grant access to all members of that group.
• POOL_ID: the unique ID for the workload identity pool that you create in Google Cloud.
• ATTRIBUTE_NAME: a user-defined name of a custom attribute that you have mapped from an external Identity Provider (IdP).
• ATTRIBUTE_VALUE: the specific value of the ATTRIBUTE_NAME used to restrict access.