IAM permissions for Document AI

The following tables list the Identity and Access Management (IAM) permissions that are associated with Document AI. IAM permissions are grouped into roles, and you assign roles to users and groups.

Location permissions

Location permission name	Description
documentai.locations.get	Get locations
documentai.locations.list	List locations

Operation permissions

Operation permission name	Description
documentai.operations.getLegacy	Get long-running operations for legacy operations (v1alpha1, v1beta2)

Processor type permissions

Processor type permission name	Description
documentai.processorTypes.get	Get processor types
documentai.processorTypes.list	List processor types

Processor permissions

Processor permission name	Description
documentai.processors.create	Create processors
documentai.processors.delete	Delete processors
documentai.processors.get	Get processors
documentai.processors.list	List processors
documentai.processors.processBatch	Process documents using processors in batch mode
documentai.processors.processOnline	Process documents using processors in online mode
documentai.processors.update	Update processors

Caution: The permissions for documentai.processors.create and documentai.datasets.update are highly privileged. A user or service account with these permissions can create new Document AI processors that can interact with any Cloud Storage bucket in your project and grant access to the files within, potentially exposing sensitive data.

Processor version permissions

Processor version permission name	Description
documentai.processorVersions.create	Create processor versions
documentai.processorVersions.delete	Delete processor versions
documentai.processorVersions.get	Get processor versions
documentai.processorVersions.list	List processor versions
documentai.processorVersions.processBatch	Process processor versions in batch mode
documentai.processorVersions.processOnline	Process processor versions in online mode
documentai.processorVersions.update	Update processor versions

Evaluations permissions

Processor version permission name	Description
documentai.evaluations.create	Create evaluations
documentai.evaluations.get	Get evaluations
documentai.evaluations.list	List evaluations

What's next

• Learn about which IAM permissions are contained in each Document AI IAM role.

• For a list of other Google Cloud permissions, see Support Level for Permissions in Custom Roles.