What problem does it solve? Google Cloud access denials (403 errors) are hard to diagnose because allow policies, deny policies, and Principal Access Boundary policies interact across the resource hierarchy. This Skill identifies the root cause of an access denial and orchestrates the correct remediation path based on whether the caller is a blocked developer or a privileged administrator. ## Core Features & Use Cases - Dual-mode troubleshooting: A Requester Flow for developers (error capture, self-service PAM JIT activation, structured escalation tickets) and a Resolver Flow for admins (authoritative policy analysis, deny exemptions, least-privilege role discovery, PAM/IAM provisioning). - Policy Troubleshooter integration: Uses the Policy Troubleshooter MCP server or gcloud fallback commands to evaluate allow, deny, and PAB policies from an error ID or principal/permission/resource tuple. - Least-privilege role discovery: A helper script finds the narrowest predefined or custom IAM role granting a specific permission, excluding overly broad basic roles. - Safety guardrails: Human-in-the-loop approval tiers for read-only, mutating, and admin role grants, plus anti-looping and access-already-granted termination rules. - Use Case: A developer hits a 403 on bigquery.datasets.create. The Skill extracts the error ID, runs Policy Troubleshooter, finds no deny policy but a missing allow binding, activates an existing PAM entitlement for one hour, and verifies access before the developer retries. ## Quick Start Ask the assistant to troubleshoot why your Google Cloud account gets a permission denied error on a specific resource, providing the error ID or the principal, permission, and resource URI.
