Implements GCP IAM and Cloud Run IAP grants as reviewable Pulumi changes in marin-iac.
npx skills add https://github.com/marin-community/marin --skill add-grant
Please help me install this Agent Skill. Skill: add-grant Source: https://github.com/marin-community/marin/tree/main/.agents/skills/add-grant Command: npx skills add https://github.com/marin-community/marin --skill add-grant
Turning an access request into a safe, reviewable infrastructure change is error-prone: personal emails must be KMS-encrypted before entering a public repo, the correct grant surface must be identified, and changes must never be applied locally. This Skill guides the full workflow from request to PR without leaking plaintext principals.
human-NNN IDs via iam_principal.py, keeping personal emails out of the public repository, commits, and PR bodies.iam_data.yaml (project roles, buckets, secrets, Artifact Registry, service accounts) and deploy-target IAM/IAP viewer grants for Echo, EvalDash, Grafana, and Loom.gh, asks for missing details instead of guessing, and opens a properly labeled PR assigned to grant approvers.iam_data.yaml, runs pre-commit checks, and opens a PR titled by capability for a reviewer to apply with pulumi up.Ask the agent to grant a specific person read access to a named GCP resource in marin-iac and open a review PR.
High-intent search queries and answers about installing and using this skill.
Register the person's email with the iam_principal.py grant or register command, which KMS-encrypts it into an opaque human-NNN ID. Then reference that ID in iam_data.yaml or the deploy-target module and open a PR for review.
Register the person's encrypted principal first, then add the principals["human-NNN"] reference to the target's iam_grants() declaration under infra/pulumi/src/iac/gcp/. The change is composed into the marin Pulumi stack and applied by a reviewer.
The marin repository is public, so human user: principals are KMS-encrypted once in the principals registry and referenced by opaque human-NNN IDs. Service accounts, groups, and domains remain plain strings since they are not personal data.
No. A local preview decrypts and prints real emails, and applying is reserved for the reviewer. Run the pre-commit checks instead; CI executes a redacted preview on the PR, and a second person runs review-grant then pulumi up.
The Skill does not guess. It posts a single comment prefixed with a robot emoji listing exactly what is missing, such as the principal, target resource, or justification, and stops without opening a half-specified PR.
lluppesmsAnalyze Azure resources and Infrastructure-as-Code files to generate cost optimization GitHub issues.
marin-communityAutomate scheduled GitHub issue and pull request triage scrub runs.
jamestexasGrant temporary IAM permissions for on-call debugging on GCP projects.
darkmatterGenerate terse Conventional Commit messages from staged diffs.