Google released Data Agent Kit, 37 skills and an IAM write block

A coding agent that writes SQL well still does not know your data. It cannot tell which tables your team trusts, how they are partitioned, or why last night's job failed. Google is now adding that context.

Google Cloud said Data Agent Kit is now generally available. The product is free. It is a set of Model Context Protocol tools and open-source skills. It plugs a coding agent into more than fifteen Google Cloud data services. The product manager Arun Nair and developer advocate Jeff Nelson announced it on the Google Cloud blog.

BigQuery Graph, Bigtable, and Managed Service for Apache Spark joined the kit at GA. They sit next to Spanner, AlloyDB, and Cloud SQL. It runs inside Antigravity, Claude Code, Codex, Cursor and other VS Code-compatible editors. It comes pre-installed in Cloud Shell and Cloud Workstations.

Two kinds of guardrail, and the difference matters

The kit carries two layers of control. Skills carry best-practice guidance. The agent is asked to follow them. MCP tools expose live schema. The agent uses them to run queries and read logs.

The plugin repository holds 37 skills under Apache 2.0. One of them is called accidental-data-loss-prevention. Its description opens with "STOP AND VERIFY". It tells the agent it "MUST obtain explicit user consent" before anything irreversible. The list it names covers destructive commands. These include DROP TABLE and TRUNCATE. A DELETE without a WHERE clause is on the list. So is one with WHERE 1=1. Storage deletions on production buckets count. So does gcloud projects delete. KMS key destruction is on the list too.

That is advice. The agent is asked to obey it.

The IAM lever is the real news

A LinkedIn commenter asked Jeff Nelson about read-only agents. Could an agent that only investigates be kept away from tools that modify infrastructure? Nelson pointed to an IAM deny policy, documented by Google. It reads a tool attribute. The policy denies mcp.googleapis.com/tools.call when tool.isReadOnly is false. It applies at the organization, folder, or project level. The agent runs as a read-only service account through impersonation. The policy is an operator saying no to a tool call. A skill is text the agent chooses whether to follow.

Three limits are named in the InfoQ coverage by Steef-Jan Wiggers. A blocked tool still appears in tools/list. The agent sees capabilities it cannot use. It finds out only on invocation. The controls cover Google Cloud MCP servers and nothing else. And resource.service and tool.name are gcloud only. They are missing from the console.

What a buyer should still check

Ankit Dongre, an AI engineer at viaSocket, told InfoQ the harder part is a write that times out. "A first-class result should carry an idempotency key plus commit status and rollbackability," he wrote. Data Agent Kit's tool results do not carry that today.

Timon Knapp, founder of the workload automation vendor Conductral, said he would start cautiously. He would give read access first. A human would confirm anything that changes a schedule or reruns a job. "A clean audit trail makes it much easier to give the agent more rights later," he wrote.

The skills are open source on GitHub. Teams can fork them. The kit costs nothing beyond the Google Cloud services the agent uses.

A team building a product on top of a model should copy one choice. Per-tool safety lives in IAM here, as a policy the system enforces on every call. A note in a system prompt is checked only when the model remembers it.

Source

Data Agent Kit is now generally available, Google Cloud. Expert context from Google's Data Agent Kit Hits GA, Splitting Agent Guardrails Between Skills and IAM, InfoQ, Steef-Jan Wiggers.