InfoQ: Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM
Google made Data Agent Kit generally available, moving it out of its summer preview. The kit is open source and installs into coding agents such as Claude Code, Cursor and Codex, providing MCP tools for more than fifteen Google Data Cloud services plus 37 Google-authored skills under Apache 2.0. Google documents an IAM deny policy that blocks MCP tools where tool.isReadOnly is false, applied at organization, folder or project level.
What changes for platform teams
Platform teams running Google Cloud MCP servers can restrict agents to read-only tools with IAM deny policies instead of relying only on skill guidance. Blocked tools still appear in tools/list, the controls apply only to Google Cloud MCP servers, and the resource.service and tool.name attributes are available only through gcloud.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules