本页概述了从组织和项目 IAM 管理员处请求资源访问权限所需的 Identity and Access Management (IAM) 角色和权限。您可以利用这些信息确保您拥有适当的访问权限，以便在 Google Distributed Cloud (GDC) 空气隔离环境中开发具有 Vertex AI 功能的应用。
本页面适用于应用运营商群组中的应用开发者，他们负责将 AI 功能集成到安全的气隙应用中。如需了解详情，请参阅 GDC 气隙环境文档的受众群体。
GDC 气隙环境使用 IAM 角色和权限来管理组织级和项目级资源访问权限。IAM 角色是一组与资源操作对应的特定权限。角色由组织或项目管理员分配给用户或服务账号。
您必须先请求 IAM 角色和权限，然后才能开始将 Vertex AI 功能集成到您的气隙应用中：
如需请求组织级访问权限：请与组织 IAM 管理员联系。他们负责授予角色和权限，以便在组织内设置 Vertex AI 并管理使用 AI 服务的项目的生命周期。
如需申请项目级访问权限：请与您的项目 IAM 管理员联系，申请项目专属的角色和权限。所有 Vertex AI 角色都必须绑定到您使用该服务的项目命名空间。
有关详情，请参阅
组织级层的预定义角色
下表详细介绍了分配给每个预定义角色的权限：
角色名称
Kubernetes 资源名称
权限说明
AI Platform Admin
ai-platform-admin
授予管理 AI 服务的权限。
Project Creator
project-creator
创建新项目。
User Cluster Admin
user-cluster-admin
创建、更新和删除 Kubernetes 集群，以及管理集群的生命周期。
项目级层的预定义角色
下表详细介绍了分配给每个预定义角色的权限：
Vertex AI 服务或模型
角色名称
Kubernetes 资源名称
权限说明
不适用
Project IAM Admin
project-iam-admin
管理项目的 IAM 许可政策并创建服务账号。
在线预测
Vertex AI Prediction User
vertex-ai-prediction-user
访问在线预测服务，向模型端点发出请求。
光学字符识别 (OCR)
AI OCR 开发者
ai-ocr-developer
访问 OCR 服务以检测图片中的文本。
Speech-to-Text
AI 语音 Chirp 开发者
ai-speech-chirp-developer
访问 Speech-to-Text 服务的 Chirp 模型，以识别语音和转写音频。
AI 语音开发者
ai-speech-developer
访问 Speech-to-Text 服务以识别语音和转写音频。
文本嵌入
AI 文本嵌入开发者
ai-text-embedding-developer
访问文本嵌入模型，将英语自然语言转换为数值向量。
AI Text Embedding Multilingual Developer
ai-text-embedding-multilingual-developer
访问 Text Embedding Multilingual 模型，将多语言自然语言转换为数值向量。
Vertex AI Search
Discovery Engine Admin
vaisearch-admin
获得对所有 Discovery Engine 资源的完整访问权限。
Discovery Engine Developer
vaisearch-developer
获取对所有 Discovery Engine 资源的读写权限。
Discovery Engine Reader
vaisearch-reader
获取对所有 Discovery Engine 资源的读取权限。
Vertex AI Translation
AI Translation Developer
ai-translation-developer
访问 Vertex AI Translation 服务以翻译文本。
Vertex AI Workbench
GDC Restricted Service Policy Admin
gdchrestrictedservice-policy-admin
获取对 GDCHRestrictedService 政策类型的完整访问权限，以控制对 Vertex AI Workbench 的访问权限。
Workbench Notebooks Admin
workbench-notebooks-admin
获取对项目命名空间中所有笔记本资源的读写权限。 创建、更新和删除笔记本。
Workbench Notebooks 查看器
workbench-notebooks-viewer
获取对项目命名空间中所有笔记本资源的只读权限，并查看 Vertex AI Workbench 界面。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eGoogle Distributed Cloud (GDC) air-gapped uses Identity and Access Management (IAM) to control access to Vertex AI services, adhering to the principle of least privilege.\u003c/p\u003e\n"],["\u003cp\u003eIAM roles, which are sets of permissions for specific actions, must be assigned to users, groups, or service accounts to enable the use of Vertex AI services.\u003c/p\u003e\n"],["\u003cp\u003ePredefined roles at both the organization and project levels dictate the permissions granted to users, and appropriate admin permissions need to be requested to utilize the services.\u003c/p\u003e\n"],["\u003cp\u003eThere are specific Vertex AI service roles detailed on the page, each linked to a Kubernetes resource name and a description of the access it provides.\u003c/p\u003e\n"],["\u003cp\u003eIf a user cannot access or use a Vertex AI service, they must request the necessary roles from their Project or Organization IAM Admin.\u003c/p\u003e\n"]]],[],null,["# Prepare IAM permissions\n\nThis page outlines the Identity and Access Management (IAM) roles and permissions necessary for requesting resource access from your Organization and Project IAM administrators. You can use this information to make sure you have the appropriate access for developing applications with Vertex AI features in Google Distributed Cloud (GDC) air-gapped environments.\n\n\u003cbr /\u003e\n\nThis page is for application developers within application operator groups who are responsible for integrating AI features into secure air-gapped applications. For more information, see [Audiences for GDC air-gapped documentation](/distributed-cloud/hosted/docs/latest/gdch/resources/audiences).\n\nGDC air-gapped uses IAM roles and permissions to manage access to resources at the organizational and project level. An IAM role is a collection of specific permissions mapped to actions on resources. A role is assigned by the organizational or project administrator to a user or service account.\n\nYou must request IAM roles and permissions before you can begin integrating Vertex AI features into your air-gapped applications:\n\n- **To request organizational-level access**: Contact your Organization IAM Admin. They grant roles and permissions for setting up Vertex AI within an organization and managing the lifecycle of projects that use AI services.\n\n- **To request project-level access**: Contact your Project IAM administrator to request project-specific roles and permissions. All Vertex AI roles must bind to the project namespace where you're using the service.\n\nFor details, see\n| **Tip:** It's important to grant and request access using the [principle of least privilege](/distributed-cloud/hosted/docs/latest/gdch//resources/permissions#preinciple-of-least-privilege), to verify you have access to only the minimum necessary permissions for your task. This keeps your resources secure and protects it from unwanted access.\n\nPredefined roles at the organization level\n------------------------------------------\n\nThe following table provides details about the permissions assigned to each\npredefined role:\n\nPredefined roles at the project level\n-------------------------------------\n\nThe following table provides details about the permissions assigned to each\npredefined role:"]]
