Google Data Agent Kit Goes GA with Two-Tier Agent Guardrails

Open-source MCP toolkit separates advisory best-practice skills from enforceable IAM policies for coding agents

By LineZotpaper AI staff

Published24 October 2026

Read Time2 min

Google has moved its Data Agent Kit out of preview and into general availability, introducing a split-level system for governing how AI coding agents interact with Google Data Cloud. The free, open-source toolkit uses both advisory skills and IAM-based access policies to protect against destructive operations.

Google has generally released its Data Agent Kit, an open-source MCP toolset that connects coding agents to more than fifteen Google Data Cloud services. The GA release adds support for BigQuery Graph, Bigtable, and Managed Service for Apache Spark.

The kit separates agent safety into two layers. The first is a set of 37 advisory skills, published on GitHub under Apache 2.0, that carry best-practice guidance. One skill, accidental-data-loss-prevention, instructs an agent to halt and obtain explicit user consent before executing destructive commands such as DROP TABLE or a DELETE without a WHERE clause.

The second layer is enforced through existing IAM infrastructure. Developer advocate Jeff Nelson explained that a read-only agent can be run through a dedicated service account, or an IAM deny policy can block tools where tool.isReadOnly is false. This policy, which denies the mcp.googleapis.com/tools.call permission, applies at the organisation, folder, or project level.

Limits remain under the model. A blocked tool still appears in the agent's tool listing, revealing capabilities it cannot invoke until runtime. The controls cover only Google Cloud MCP servers, and attributes such as resource.service are exclusive to gcloud.

Early practitioner commentary highlighted both strengths and gaps. AI solutions architect Amel Habira said the combination of short-lived credentials, a read-only attribute, and warnings before notebook cell execution enables containment at both the access and data layers. Ankit Dongre, an AI engineer, noted the absence of idempotency keys and commit status in tool results, arguing the harder boundary is repeat-safe execution rather than access control. Timon Knapp, founder of Conductral, recommended starting with read-only access and human confirmation, using a clean audit trail to expand agent permissions over time.

The approach contrasts with Microsoft's Agent 365 preview, which enforces governance at an API management gateway. Google's kit propagates the user identity, allowing existing row and column security to apply alongside its tool-level IAM policies.

Data Agent Kit is free and its skills are available on GitHub.

Analysis

Why This Matters

Provides a production-ready pattern for constraining AI agents in cloud data environments, separating aspirational safety advice from enforceable policy.
Highlights the gap between MCP-level access control and the need for repeat-safe execution and rollback capability.
Sets governance design decisions around advisory skills versus enforced IAM that other cloud platforms are likely to adopt as agent deployment scales.

Background

As AI coding agents grow more capable, cloud platforms are racing to provide safety mechanisms that prevent destructive queries and infrastructure changes. The Model Context Protocol (MCP) has emerged as a standard channel for agent-tool interaction, raising questions about how to secure that channel. Google's Data Agent Kit, previewed over the northern summer, is one of the first governance-focused offerings to reach general availability.

Key Perspectives

Amel Habira, AI solutions architect: praised the kit's short-lived credentials, read-only attribute, and notebook cell warnings, saying they allow containment "at both the access layer and the data layer." Ankit Dongre, AI engineer: argued that permission scope and repeat-safe execution is the harder production boundary, noting the lack of idempotency keys and commit status for timed-out writes. Timon Knapp, founder of Conductral: advised operators to start with read-only access and human confirmation, relying on a clean audit trail to grant agents more rights over time.

What to Watch

Whether Google adds idempotency keys and commit status to tool results, addressing the gap identified by practitioners.
How enterprise teams reconcile the advisory nature of skills like accidental-data-loss-prevention with the need for verifiable enforcement.
The evolution of competing governance models from Microsoft, AWS, and others as the design decisions in this space settle into industry practice.

Sources

Google’s Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM · InfoQ

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedThe headline says Google’s Data Agent Kit has reached GA with two-tier agent guardrails.InfoQ: “Google recently made Data Agent Kit generally available , moving it out of the preview it ran through the summer. ... It ships two kinds of control”
SupportedThe summary describes an open-source MCP toolkit that separates advisory skills from enforceable IAM policies for coding agents.InfoQ: “It is free, it is open source, and it installs into coding agents Google does not own. It ships two kinds of control”
SupportedGoogle moved Data Agent Kit out of preview and into general availability.InfoQ: “Google recently made Data Agent Kit generally available , moving it out of the preview it ran through the summer.”
SupportedThe toolkit connects coding agents to more than fifteen Google Data Cloud services.InfoQ: “Data Agent Kit is a set of MCP tools connecting an agent to more than fifteen Google Data Cloud services”
SupportedThe GA release adds BigQuery Graph, Bigtable and Managed Service for Apache Spark.InfoQ: “With the GA release, the company adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark.”
SupportedThe kit has 37 advisory skills published on GitHub under Apache 2.0.InfoQ: “The plugin repository carries 37 skills under Apache 2.0”
SupportedThe accidental-data-loss-prevention skill instructs agents to halt and obtain explicit consent before destructive actions such as DROP TABLE or DELETE without a WHERE clause.InfoQ: “tells the agent it “MUST obtain explicit user consent” before anything irreversible, listing DROP TABLE, TRUNCATE, a DELETE missing a WHERE clause”
SupportedJeff Nelson said read-only agents can use a dedicated read-only service account or an IAM deny policy for tools where tool.isReadOnly is false.InfoQ: “run the agent as a read-only service account through impersonation, or use “an IAM deny policy that blocks any MCP tool where tool.isReadOnly is false.””
SupportedThe deny policy blocks mcp.googleapis.com/tools.call and can apply at the organisation, folder or project level.InfoQ: “It denies the mcp.googleapis.com/tools.call permission, and applies at the organization, folder, or project level.”
SupportedA blocked tool remains visible to the agent, and the controls cover only Google Cloud MCP servers; resource.service is gcloud-only.InfoQ: “A blocked tool still appears in tools/list, so the agent sees capabilities it cannot use and finds out only on invocation. The controls cover Google Cloud MCP servers and nothing else. And resource.service and tool.name are gcloud only”
Partly supportedAmel Habira said that short-lived credentials, a read-only attribute and notebook-cell warnings enable containment at both the access and data layers.InfoQ: “He wrote: Combine that with branching and time travel on the Iceberg side, and you can imagine containment at both the access layer and the data layer.”
Partly supportedAnkit Dongre said tool results lack idempotency keys and commit status, and that repeat-safe execution is the harder boundary rather than access control.InfoQ: “The production boundary is permission scope plus repeat-safe execution: what happens when an agent retries a write after a timeout”