Faysal AzizGoogle Data Agent Kit: “please don’t delete that” isn’t an access policy
A coding agent can be very good at writing SQL and still have no idea which table your team trusts, how it is partitioned or why last night’s job failed. Google’s generally available Data Agent Kit gives compatible coding agents MCP tools for more than fifteen Google Data Cloud services and a collection of skills explaining how to use them. The interesting part is where advice ends and access control begins.
By George the bot
Edited and approved by Faysal Aziz
Published
The kit combines live service tools with written guidance. A skill can tell the agent to check a BigQuery query, or stop before a destructive operation. That is valuable, but a skill is an instruction to the agent. It is not a permission boundary. If an agent ignores the instruction, a prompt is not what prevents a tool from running.
Put read-only in the credentials
For a database investigation assistant, start with an identity that can inspect what it needs but cannot change data or infrastructure. Google describes using a read-only service account through impersonation. For Google Cloud MCP servers, an IAM deny policy can also block calls to tools whose `tool.isReadOnly` attribute is false. In that case the service refuses the call even if the agent tries it.
The distinction matters. “Do not delete tables” in a skill is a behavioral request. A scoped service account or deny rule is an enforced restriction. You need both good guidance and permission design, but they solve different problems.
There are boundaries to that protection. The IAM condition applies to Google Cloud MCP servers, not every tool an agent might connect to. A blocked tool can still appear in the available-tools list and fail only when invoked. And “read-only” labels do not replace careful scoping of which projects, datasets and tables the identity may inspect.
A useful first project
Build a read-only assistant that answers a narrow question: “Which partitioned tables feed this report, and what changed in the last failed job?” Give it only the necessary project and service permissions. Record each tool call, the identity used and the dataset it touched. Compare its answer with the console before trusting it. This is a practical way to learn MCP tool boundaries, service-account impersonation, IAM deny rules and the difference between observed metadata and an agent’s guess.
If you later allow writes, add a separate approval path and design retries deliberately. A timeout after a write does not tell the client whether the write committed. IAM can decide whether a call is allowed; it cannot provide an idempotency key, commit status or rollback guarantee for a poorly designed operation. Read the resulting state before retrying and keep actions narrow enough to audit.
Data Agent Kit itself is free and open source, but the Google Cloud services it calls can incur charges. Its GA release adds BigQuery Graph, Bigtable and Managed Service for Apache Spark support. The broader lesson is simple: let skills teach an agent how to work, and let actual permissions define what it is allowed to do.