Google's Data Agent Kit reaches GA with 37 open-source skills and an IAM deny policy for read-only agents

Google has made Data Agent Kit generally available, ending a preview that ran through the summer, InfoQ reported on October 24, 2026. The kit is free, open source, and installs into coding agents Google does not own. Its guardrails come in two forms: skills that ask the agent to behave, and IAM policies that enforce limits.

What ships

Data Agent Kit is a set of MCP tools connecting an agent to more than fifteen Google Data Cloud services, plus Google-authored skills covering practices such as optimizing BigQuery SQL or designing Bigtable row keys. It runs in Antigravity, Claude Code, Codex, Cursor, and VS Code-compatible editors, and comes preinstalled in Cloud Shell and Cloud Workstations.

The GA release adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark. The plugin repository carries 37 skills under Apache 2.0, each naming Google as publisher. Version 1.0.0 was cut on September 29 and 1.1.0 on October 13, so teams can pin a version. The kit costs nothing beyond the Google Cloud services an agent uses, and the skills are on GitHub and forkable.

Product manager Arun Nair and developer advocate Jeff Nelson, who wrote Google's launch post, describe the problem as agents writing good SQL while knowing nothing about "which tables exist, how they're partitioned, which ones your team trusts, or why last night's job failed."

Two kinds of guardrail

Skills (advisory). The accidental-data-loss-prevention skill opens with "STOP AND VERIFY" and says the agent "MUST obtain explicit user consent" before irreversible actions. It lists DROP TABLE, TRUNCATE, a DELETE missing a WHERE clause or using 1=1, storage deletions against production buckets, gcloud projects delete, and KMS key destruction. The procedure is halt, explain the impact, wait for affirmative consent. InfoQ notes this is advice: the agent is asked to obey it.

IAM (enforced). Asked on LinkedIn whether read-only investigation can be isolated from tools that modify infrastructure, Nelson said it is handled in IAM, not per agent. Options are running the agent as a read-only service account through impersonation, or an IAM deny policy that blocks any MCP tool where tool.isReadOnly is false. The documented condition is:

api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false

It denies the mcp.googleapis.com/tools.call permission and applies at the organization, folder, or project level. Companion attributes cover resource.service and tool.name.

Limits

• A blocked tool still appears in tools/list, so the agent sees capabilities it cannot use and finds out only on invocation.
• The controls cover Google Cloud MCP servers and nothing else.
• resource.service and tool.name are gcloud only, absent from the console.

Practitioner reaction

Amel Habira, an AI solutions architect, called the short-lived credentials, the read-only attribute, and a warning before agents execute notebook cells encouraging. He pointed to branching and time travel on the Iceberg side as a possible second containment layer.

Ankit Dongre, an AI engineer at viaSocket, argued the production boundary is permission scope plus repeat-safe execution. IAM and dry runs cover authorization and preflight, he said, but "do not tell the agent whether a timed-out write committed." He wants tool results to carry an idempotency key, commit status, and rollbackability. Data Agent Kit's tool results do not carry that today, per InfoQ.

Timon Knapp, founder of workload automation vendor Conductral, said he would start with read access and suggestions, with a human confirming anything that changes a schedule or reruns a job.

Comparison with Microsoft

InfoQ contrasts the design with Microsoft's Agent 365 integration with Azure API Management, in public preview. That keeps governance intent in a Microsoft 365 admin surface and enforces it at a gateway. Per-tool blocking there requires a preview tier, and the application key is "gateway-scoped," reaching every model and tool. Google authorizes per tool in the IAM language customers already use and propagates the user's identity so row and column security applies.

What this means

The kit separates guidance from enforcement. The skills improve agent behavior, but only the IAM deny policy can actually stop a write. Teams that need a hard read-only boundary should rely on the deny condition or a read-only service account, not the consent prompt in a skill.

The documented gaps matter for design: coverage is limited to Google Cloud MCP servers, some attributes are gcloud only, and tool results lack idempotency and commit status. Version pinning, from 1.0.0 and 1.1.0, lets teams test changes before adopting them.