IAM permissions change log

This page describes changes to the public Identity and Access Management (IAM) permissions for all Generally Available (GA) and Preview services on Google Cloud. This change log can help you maintain and troubleshoot your custom roles.

When a permission is added, IAM does not automatically add the permission to your custom roles.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

IAM changes for the week of 2026-09-15

Service Description
Gemini Enterprise Agent Platform

The following permissions have been added to the Agent Platform Administrator role (roles/aiplatform.admin):

aiplatform.notebookRuntimeTemplates.setDefault

Gemini Enterprise Agent Platform

The following permissions have been added to the Colab Enterprise Admin role (roles/aiplatform.colabEnterpriseAdmin):

aiplatform.notebookRuntimeTemplates.setDefault

Gemini Enterprise Agent Platform

The following permissions have been added to the Notebook Runtime Admin role (roles/aiplatform.notebookRuntimeAdmin):

aiplatform.notebookRuntimeTemplates.setDefault

Gemini Enterprise Agent Platform

The following permissions have been added to the Vertex AI Service Agent role (roles/aiplatform.serviceAgent):

agentregistry.agents.get
agentregistry.agents.list
agentregistry.endpoints.get
agentregistry.endpoints.list
agentregistry.mcpServers.get
agentregistry.mcpServers.list

BigQuery

The following permissions have been added to the BigQuery Studio Admin role (roles/bigquery.studioAdmin):

aiplatform.notebookRuntimeTemplates.setDefault

Google Security Operations

The following permissions have been added to the Chronicle API Restricted Data Access Viewer role (roles/chronicle.restrictedDataAccessViewer):

chronicle.environmentGroups.get
chronicle.integrations.get
chronicle.legacySoarAdvancedReports.get
chronicle.legacySoarUsers.get
chronicle.moduleSettings.rebranding
chronicle.moduleSettingsProperties.get
chronicle.socRoles.get
chronicle.userLocalizations.get
chronicle.userNotifications.get

Firebase Cloud Messaging

The Firebase Cloud Messaging Service Editor role (roles/cloudmessaging.editor) has reached General Availability (GA).

Cloud Tasks

The Cloud Tasks Admin role (roles/cloudtasks.admin) has reached General Availability (GA).

Cloud Tasks

The Cloud Tasks Editor role (roles/cloudtasks.editor) has reached General Availability (GA).

Cloud Tasks

The Cloud Tasks Queue Admin role (roles/cloudtasks.queueAdmin) has reached General Availability (GA).

Cloud Tasks

The Cloud Tasks Task Deleter role (roles/cloudtasks.taskDeleter) has reached General Availability (GA).

Cloud Tasks

The Cloud Tasks Viewer role (roles/cloudtasks.viewer) has reached General Availability (GA).

Developer Connect

The Developer Connect Insights Admin role (roles/developerconnect.insightsAdmin) has reached General Availability (GA).

Developer Connect

The Developer Connect Insights Config Agent role (roles/developerconnect.insightsAgent) has reached General Availability (GA).

Developer Connect

The Developer Connect Insights Viewer role (roles/developerconnect.insightsViewer) has reached General Availability (GA).

Developer Connect

The following permissions have been added to the Developer Connect Insights Config Agent role (roles/developerconnect.insightsAgent):

cloudasset.feeds.delete

Device Run

The Device Run Service Agent role (roles/devicerun.serviceAgent) has reached General Availability (GA).

Discovery Engine

The following permissions have been added to the Discovery Engine Service Agent role (roles/discoveryengine.serviceAgent):

agentregistry.operations.cancel
agentregistry.operations.delete
agentregistry.operations.get
agentregistry.operations.list

Basic Role

The following permissions have been added to the Editor role (roles/editor):

saasservicemgmt.poolKinds.create
saasservicemgmt.poolKinds.delete
saasservicemgmt.poolKinds.get
saasservicemgmt.poolKinds.list
saasservicemgmt.poolKinds.update
saasservicemgmt.pools.create
saasservicemgmt.pools.delete
saasservicemgmt.pools.get
saasservicemgmt.pools.list
saasservicemgmt.pools.update
saasservicemgmt.saasReleases.create
saasservicemgmt.saasReleases.delete
saasservicemgmt.saasReleases.get
saasservicemgmt.saasReleases.list
saasservicemgmt.saasReleases.update
saasservicemgmt.tenantOperations.create
saasservicemgmt.tenantOperations.delete
saasservicemgmt.tenantOperations.get
saasservicemgmt.tenantOperations.list
saasservicemgmt.tenantOperations.update
saasservicemgmt.unitGroupOperations.create
saasservicemgmt.unitGroupOperations.delete
saasservicemgmt.unitGroupOperations.get
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroupOperations.update
saasservicemgmt.unitGroups.create
saasservicemgmt.unitGroups.delete
saasservicemgmt.unitGroups.get
saasservicemgmt.unitGroups.list
saasservicemgmt.unitGroups.update
securitycentermanagement.securityCenterServices.update

Firebase

The following permissions have been added to the Firebase Admin role (roles/firebase.admin):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase

The following permissions have been added to the Firebase Editor role (roles/firebase.editor):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase

The following permissions have been added to the Firebase Quality Admin role (roles/firebase.qualityAdmin):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase

The following permissions have been added to the Firebase Quality Viewer role (roles/firebase.qualityViewer):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase

The following permissions have been added to the Firebase Viewer role (roles/firebase.viewer):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase Crashlytics

The following permissions have been added to the Firebase Crashlytics Admin role (roles/firebasecrashlytics.admin):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Firebase Crashlytics

The following permissions have been added to the Firebase Crashlytics Viewer role (roles/firebasecrashlytics.viewer):

logging.logEntries.download
logging.views.access
logging.views.listLogs
logging.views.listResourceKeys
logging.views.listResourceValues

Cluster Director

The following permissions have been added to the Cluster Director Service Agent role (roles/hypercomputecluster.serviceAgent):

hypercomputecluster.clusters.update

Identity and Access Management

The following permissions have been added to the ML Engineer role (roles/iam.mlEngineer):

aiplatform.notebookRuntimeTemplates.setDefault

Identity and Access Management

The following permissions have been added to the Security Admin role (roles/iam.securityAdmin):

saasservicemgmt.poolKinds.list
saasservicemgmt.pools.list
saasservicemgmt.saasReleases.list
saasservicemgmt.tenantOperations.list
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroups.list

Identity and Access Management

The following permissions have been added to the Security Auditor role (roles/iam.securityAuditor):

saasservicemgmt.poolKinds.list
saasservicemgmt.pools.list
saasservicemgmt.saasReleases.list
saasservicemgmt.tenantOperations.list
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroups.list

Identity and Access Management

The following permissions have been added to the Security Reviewer role (roles/iam.securityReviewer):

saasservicemgmt.poolKinds.list
saasservicemgmt.pools.list
saasservicemgmt.saasReleases.list
saasservicemgmt.tenantOperations.list
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroups.list

Identity and Access Management

The following permissions have been added to the Support User role (roles/iam.supportUser):

saasservicemgmt.poolKinds.get
saasservicemgmt.poolKinds.list
saasservicemgmt.pools.get
saasservicemgmt.pools.list
saasservicemgmt.saasReleases.get
saasservicemgmt.saasReleases.list
saasservicemgmt.tenantOperations.get
saasservicemgmt.tenantOperations.list
saasservicemgmt.unitGroupOperations.get
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroups.get
saasservicemgmt.unitGroups.list

Oracle Database@Google Cloud

The following permissions have been added to the Oracle Database@Google Cloud admin role (roles/oracledatabase.admin):

oracledatabase.dbSystemComputePerformances.list

Oracle Database@Google Cloud

The following permissions have been added to the Oracle Database@Google Cloud DB System Admin role (roles/oracledatabase.dbSystemAdmin):

oracledatabase.dbSystemComputePerformances.list

Oracle Database@Google Cloud

The following permissions have been added to the Oracle Database@Google Cloud DB System Viewer role (roles/oracledatabase.dbSystemViewer):

oracledatabase.dbSystemComputePerformances.list

Oracle Database@Google Cloud

The following permissions have been added to the Oracle Database@Google Cloud viewer role (roles/oracledatabase.viewer):

oracledatabase.dbSystemComputePerformances.list

Basic Role

The following permissions have been added to the Owner role (roles/owner):

saasservicemgmt.poolKinds.create
saasservicemgmt.poolKinds.delete
saasservicemgmt.poolKinds.get
saasservicemgmt.poolKinds.list
saasservicemgmt.poolKinds.update
saasservicemgmt.pools.create
saasservicemgmt.pools.delete
saasservicemgmt.pools.get
saasservicemgmt.pools.list
saasservicemgmt.pools.update
saasservicemgmt.saasReleases.create
saasservicemgmt.saasReleases.delete
saasservicemgmt.saasReleases.get
saasservicemgmt.saasReleases.list
saasservicemgmt.saasReleases.update
saasservicemgmt.tenantOperations.create
saasservicemgmt.tenantOperations.delete
saasservicemgmt.tenantOperations.get
saasservicemgmt.tenantOperations.list
saasservicemgmt.tenantOperations.update
saasservicemgmt.unitGroupOperations.create
saasservicemgmt.unitGroupOperations.delete
saasservicemgmt.unitGroupOperations.get
saasservicemgmt.unitGroupOperations.list
saasservicemgmt.unitGroupOperations.update