本頁說明如何透過 Gemini 輔助，找出並授予主體最低權限的 Identity and Access Management (IAM) 預先定義角色。
您可以使用 IAM 角色挑選器，要求 Gemini 建議應授予主體的角色。一般來說，如要找出合適的預先定義角色並授予權限，您需要搜尋 IAM 角色和權限索引，或角色頁面 (位於Google Cloud 控制台)。使用 IAM 角色挑選器，您可以描述要讓主體執行的動作，以及執行這些動作所需的資源。根據您的輸入內容，Gemini 會建議最嚴格的預先定義角色，並認為這些角色適合您。
Gemini 可以為個別主體建議預先定義的角色。如果 Gemini 建議在專案層級授予角色，您可以使用 IAM 角色挑選器授予該角色。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-11 (世界標準時間)。"],[],[],null,["# Get predefined role suggestions with Gemini assistance\n\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nThis page describes how you can find and grant the least permissive\nIdentity and Access Management (IAM) predefined roles to your principals with\nGemini assistance.\n\nThe IAM role picker lets you ask Gemini which roles you\nshould grant to your principals. Typically, to find the right predefined roles\nto grant, you would need to search through the\n[IAM roles and permissions index](/iam/docs/roles-permissions) or\nthe [**Roles** page in the\nGoogle Cloud console](https://console.cloud.google.com/iam-admin/roles). With the\nIAM role picker, you can describe the actions you want the principal to\nperform and the resources that they need to perform them on. Based on your\ninput, Gemini suggests the least permissive predefined roles that\nit considers appropriate.\n\nGemini can suggest predefined roles for individual principals. If\nGemini suggests granting a role at the project level, then you\ncan use the IAM role picker to grant that role.\n\nGemini *can't* suggest granting the following things:\n\n- Custom roles\n- Roles for multiple principals\n\nLearn [how and when Gemini\nfor Google Cloud uses your data](/gemini/docs/discover/data-governance).\n\nBefore you begin\n----------------\n\nTo enable the IAM role picker in your project, enable the Gemini for Google\nCloud API in the Google Cloud console.\n\n[Enable the API](https://console.cloud.google.com/apis/enableflow;apiid=cloudaicompanion.googleapis.com)\n\nIf you don't enable the API, the **Help me choose roles** button to access the\nIAM role picker in the Google Cloud console will be disabled.\n\n### Required Roles\n\n\nTo get the permissions that\nyou need to use the IAM role picker,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- Ask Gemini for role suggestions: [Gemini for Google Cloud User](/iam/docs/roles-permissions/cloudaicompanion#cloudaicompanion.user) (`roles/cloudaicompanion.user`)\n- Grant suggested roles: [Project IAM Admin](/iam/docs/roles-permissions/resourcemanager#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nGet role suggestions with Gemini assistance\n-------------------------------------------\n\n| As an early-stage technology, Gemini for Google Cloud\n| products can generate output that seems plausible but is factually incorrect. We recommend that you\n| validate all output from Gemini for Google Cloud products before you use it.\n| For more information, see\n| [Gemini for Google Cloud and responsible AI](/gemini/docs/discover/responsible-ai).\n\nTo get role suggestions from Gemini, you can access the\nIAM role picker on pages in the Google Cloud console that let you grant access\nat the project level. For example, the IAM role picker is\navailable on the following pages:\n\n- The **IAM** page\n- The **Service Accounts** page\n- The Google Cloud console **Dashboard** page\n\nThe following procedure uses the\n**IAM** page as the primary entry point.\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go\n to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=project)\n2. Select a project.\n\n3. Select a principal to get role suggestions for:\n\n - To get role suggestions for a principal who already has other roles on the\n resource, find a row containing the principal, and then click edit **Edit principal** in that row.\n\n To grant a role to a [service agent](/iam/docs/service-account-types#service-agents), select the **Include\n Google-provided role grants** checkbox to see its email address.\n | **Note:** You cannot edit inherited roles when managing access to a resource. To edit inherited roles, go to the resource where the role was granted.\n - To get role suggestions for a principal who doesn't have any existing roles on the\n resource, click person_add **Grant\n Access** , then enter a\n [principal identifier](/iam/docs/principal-identifiers)---for\n example,\n `my-user@example.com` or\n `//iam.googleapis.com/locations/global/workforcePools/example-pool/group/example-group@example.com`.\n\n4. To open the IAM role picker dialog, click **Help me choose roles**.\n\n5. In your own words, describe the action you want the principal to perform and\n the resource in the project that they need to perform it on.\n\n6. Click **Suggest roles**. Based on your input, Gemini suggests\n the least permissive predefined roles that it considers appropriate.\n\n To get more information about the roles and why Gemini\n suggested them, click **Show reasoning** . We also recommend using the [roles\n and permissions reference](/iam/docs/roles-permissions) to validate\n Gemini's suggested roles before granting them to the\n principal.\n7. Optional: If Gemini doesn't suggest the right roles, you can\n refine your prompt.\n\n 1. To modify your prompt, click **Edit**.\n 2. Edit the description and then click **Update**. Gemini updates its role suggestions based on the new description.\n8. To accept the suggestions, click **Add roles**.\n\n9. Optional: Add a [condition](/iam/docs/conditions-overview) to the role.\n\n10. Click **Save**. The principal is granted the role on the resource.\n\nYou can grant *project-level* roles suggested by Gemini directly\nfrom the IAM role picker. For organization-, folder-, or resource-level role\nsuggestions, note the suggested roles and grant them to the principal at\nthe appropriate level using the typical process in the Google Cloud console.\nFor more information about granting roles, see [Manage access to projects,\nfolders, and organizations](/iam/docs/granting-changing-revoking-access).\n\nIf you don't have the permissions to grant the roles at the organization,\nfolder, or resource levels, contact your administrator.\n\nSample use cases\n----------------\n\nThe following table illustrates some example use cases where\nGemini can help you identify the least permissive roles for your\nprincipals.\n\nBest practices\n--------------\n\nTo help Gemini provide the most accurate suggestions for your use\ncase, we recommend that you adhere to the following best practices when drafting\nyour prompt.\n\n- **Clearly describe your use case.** Avoid using vague language in your\n prompts. Be as clear as possible about what actions you want the principal to\n perform on which services and resource types.\n\n- **Use official names.** Use the official names of Google Cloud services,\n resource types, and API operations in your prompt. If you are unsure about the\n official names of services, resource types, or API operations, we recommend\n consulting the official product documentation.\n\nTroubleshooting\n---------------\n\nThis section describes resolutions for common issues with the IAM role picker.\n\n### Gemini suggests roles that you can't grant at the project level\n\nGemini can suggest roles at all resource levels; however, you can\nonly use the IAM role picker to grant the *project-level* roles that are\nsuggested. When Gemini suggests organization, folder, or\nresource-level roles, the IAM role picker indicates that there are\nsuggested roles that can't be granted and the **Add roles** button will be\ndisabled.\n\nWhen this occurs, you can copy the suggested roles and grant them to the\nprincipal at the appropriate level using the typical process in the\nGoogle Cloud console. For more information on granting roles, see [Manage\naccess to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\nIf you don't have the permissions to grant the roles at the organization,\nfolder, or resource levels, contact your administrator.\n\nPricing\n-------\n\nThe IAM role picker is offered at no cost as part of\n[Gemini Cloud Assist](/products/gemini/cloud-assist). For more\ninformation about Gemini Cloud Assist pricing, see\n[Gemini for Google Cloud\npricing](/products/gemini/pricing#gemini-cloud-assist-pricing).\n| **Note:** The IAM role picker is separate from the Gemini Cloud Assist chat feature provided in the Google Cloud console. Therefore, responses to role-related prompts in the Gemini Cloud Assist chat might differ from the suggestions provided by the IAM role picker.\n\nWhat's next\n-----------\n\n- Read [Gemini for Google Cloud\n overview](/gemini/docs/overview).\n- Learn [how Gemini for Google Cloud uses your\n data](/gemini/docs/discover/data-governance).\n- Learn how to manually [find the right predefined roles](/iam/docs/choose-predefined-roles)"]]
