What problem does it solve?
Changing IAM policies on Google Cloud Projects, Folders, or Organizations risks accidentally revoking permissions that active workloads depend on, causing production outages. This Skill prevents that by replaying the last 90 days of access logs against a proposed policy before any change is applied.
Core Features & Use Cases
- Policy Simulation: Uses the Google Cloud Policy Simulator to replay historical access logs against a proposed IAM v1 allow policy and detect revoked access.
- Safety-Gated Workflow: Enforces a strict Plan, Simulate, Analyze, Apply sequence with no-op detection, failure gates, and mandatory user confirmation before applying changes.
- Multi-Scope Support: Works across Projects, Folders, and Organizations using standard gcloud commands.
- Use Case: Before removing an apparently unused role from a service account on a production project, run a simulation to confirm no workload used that permission in the last 90 days, then apply the change only if the simulation reports zero revoked accesses.
Quick Start
Ask the assistant to simulate removing a specific IAM role binding from a Google Cloud project and apply the change only if the simulation shows no disrupted access.
