Service agents

Some Google Cloud services have service agents that allow the service to access your resources. If an API requires a service agent, then Google Cloud creates the service agent at some point after you activate and use the API. You might see evidence of these service agents in several different places, including a project's allow policy and audit log entries for various services. For more information about when Google Cloud creates service agents, see Service agent creation.

If you manage your allow policies with a declarative framework or a policies-as-code system, you might want to create and grant roles to a service agent before you use the service it belongs to. In these cases, after you identify the service agent you need to create, you can trigger service agent creation yourself without using the service.

This page provides details about the service agents for all services that are publicly available, including the following:

• The domain name used in the service agent's email address.

• The role that the service agent is granted on the project.

  When the service agent is created, Google Cloud grants this role automatically.

Warning: Do not grant service agent roles to any principals except service agents. Some service agent roles contain very powerful permissions, and the permissions within these roles can change without notice. Instead, choose a different predefined role, or create a custom role with the permissions you need.

Google Cloud can introduce new service agents at any time, both for existing services and for new services. Both the creation time and the email address format for service agents are subject to change.

Service agent	Role
AI Platform Custom Code Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Custom Code Service Agent (roles/aiplatform.customCodeServiceAgent) Granted on the project.
AI Platform Example Store Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	None
AI Platform Fine Tuning Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Service Agent (roles/aiplatform.serviceAgent) Granted on the project.
AI Platform Infra Spanner Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	None
AI Platform Rapid Eval Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Rapid Eval Service Agent (roles/aiplatform.rapidevalServiceAgent) Granted on the project.
AI Platform Reasoning Engine Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Reasoning Engine Service Agent (roles/aiplatform.reasoningEngineServiceAgent) Granted on the project.
AI Platform Resource Identity Service agent for aiplatform.googleapis.com. [e-mail]	None
AI Platform Service Agent Primary service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Service Agent (roles/aiplatform.serviceAgent) Granted on the project.
API Hub Service Account Primary service agent for apihub.googleapis.com. [e-mail]	None
API Keys Service Account Primary service agent for apikeys.googleapis.com. [e-mail]	None
APIM Service Account Primary service agent for apim.googleapis.com. [e-mail]	APIM API Discovery Service Agent (roles/apim.apiDiscoveryServiceAgent) Granted on the project.
ASM Mesh Control Plane Service Account Service agent for meshconfig.googleapis.com. [e-mail]	Mesh Managed Control Plane Service Agent (roles/meshcontrolplane.serviceAgent) Granted on the project.
ASM Mesh Data Plane Service Account Service agent for meshconfig.googleapis.com. [e-mail]	Mesh Data Plane Service Agent (roles/meshdataplane.serviceAgent) Granted on the project.
Access Approval Service Agent Service agent for accessapproval.googleapis.com. For the project: [e-mail] For the folder: [e-mail] For the organization: [e-mail]	None
Ads Data Hub Service Account Primary service agent for adsdatahub.googleapis.com. [e-mail]	None
AlloyDB Service Account Primary service agent for alloydb.googleapis.com. [e-mail]	AlloyDB Service Agent (roles/alloydb.serviceAgent) Granted on the project.
Anthos Audit Service Account Primary service agent for anthosaudit.googleapis.com. [e-mail]	Anthos Audit Service Agent (roles/anthosaudit.serviceAgent) Granted on the project.
Anthos Config Management Service Account Primary service agent for anthosconfigmanagement.googleapis.com. [e-mail]	Anthos Config Management Service Agent (roles/anthosconfigmanagement.serviceAgent) Granted on the project.
Anthos Identity Service Account Primary service agent for anthosidentityservice.googleapis.com. [e-mail]	Anthos Identity Service Agent (roles/anthosidentityservice.serviceAgent) Granted on the project.
Anthos Multi-Cloud Container Service Agent Service agent for gkemulticloud.googleapis.com. [e-mail]	Anthos Multi-Cloud Container Service Agent (roles/gkemulticloud.containerServiceAgent) Granted on the project.
Anthos Multi-Cloud Control Plane Machine Service Agent Service agent for gkemulticloud.googleapis.com. [e-mail]	Anthos Multi-Cloud Control Plane Machine Service Agent (roles/gkemulticloud.controlPlaneMachineServiceAgent) Granted on the project.
Anthos Multi-Cloud Node Pool Machine Service Agent Service agent for gkemulticloud.googleapis.com. [e-mail]	Anthos Multi-Cloud Node Pool Machine Service Agent (roles/gkemulticloud.nodePoolMachineServiceAgent) Granted on the project.
Anthos Multi-Cloud Service Agent Primary service agent for gkemulticloud.googleapis.com. [e-mail]	Anthos Multi-Cloud Service Agent (roles/gkemulticloud.serviceAgent) Granted on the project.
Anthos Policy Controller Service Account Primary service agent for anthospolicycontroller.googleapis.com. [e-mail]	Anthos Policy Controller Service Agent (roles/anthospolicycontroller.serviceAgent) Granted on the project.
Anthos Service Account Primary service agent for anthos.googleapis.com. [e-mail]	Anthos Service Agent (roles/anthos.serviceAgent) Granted on the project.
Anthos Service Mesh Service Account Service agent for meshconfig.googleapis.com. [e-mail]	Anthos Service Mesh Service Agent (roles/anthosservicemesh.serviceAgent) Granted on the project.
Anthos Support Service Account Primary service agent for connectgateway.googleapis.com. [e-mail]	Anthos Support Service Agent (roles/anthossupport.serviceAgent) Granted on the project.
Apigee Registry Service Account Primary service agent for apigeeregistry.googleapis.com. [e-mail]	None
Apigee Service Agent Primary service agent for apigee.googleapis.com. [e-mail]	Apigee Service Agent (roles/apigee.serviceAgent) Granted on the project.
App Development Experience Service Account Primary service agent for appdevelopmentexperience.googleapis.com. [e-mail]	App Development Experience Service Agent (roles/appdevelopmentexperience.serviceAgent) Granted on the project.
App Engine Flexible Environment Service Agent Primary service agent for appengineflex.googleapis.com. [e-mail]	App Engine flexible environment Service Agent (roles/appengineflex.serviceAgent) Granted on the project.
App Engine Standard Environment Service Agent Primary service agent for appenginestandard.googleapis.com. [e-mail]	App Engine Standard Environment Service Agent (roles/appengine.serviceAgent) Granted on the project.
App Hub Service Account Primary service agent for apphub.googleapis.com. [e-mail]	None
Application Integration Service Agent Primary service agent for integrations.googleapis.com. [e-mail]	Application Integration Service Agent (roles/integrations.serviceAgent) Granted on the project.
Artifact Registry Service Agent Primary service agent for artifactregistry.googleapis.com. [e-mail]	Artifact Registry Service Agent (roles/artifactregistry.serviceAgent) Granted on the project.
Assured OSS Service Agent Service agent for assuredoss.googleapis.com. [e-mail]	None
Assured Workloads Service Agent Service agent for assuredworkloads.googleapis.com. [e-mail]	None
AssuredWorkloads Service Account Primary service agent for assuredworkloads.googleapis.com. [e-mail]	Assured Workloads Service Agent (roles/assuredworkloads.serviceAgent) Granted on the project.
Attack Surface Management Service Agent Service agent for securitycenter.googleapis.com. [e-mail]	None
Audit Manager Service Agent Primary service agent for auditmanager.googleapis.com. [e-mail]	Audit Manager Auditing Service Agent (roles/auditmanager.serviceAgent) Granted on the project.
Audit Manager Service Agent Service agent for auditmanager.googleapis.com. For the folder: [e-mail] For the organization: [e-mail]	None
AutoML Recommendations Service Account Primary service agent for recommendationengine.googleapis.com. [e-mail]	Recommendations AI Service Agent (roles/automlrecommendations.serviceAgent) Granted on the project.
AutoML Service Agent Primary service agent for automl.googleapis.com. [e-mail]	AutoML Service Agent (roles/automl.serviceAgent) Granted on the project.
Backup and DR Runner Service Agent Service agent for backupdr.googleapis.com. [e-mail]	None
Backup and DR Service Agent Primary service agent for backupdr.googleapis.com. [e-mail]	Backup and DR Service Agent (roles/backupdr.serviceAgent) Granted on the project.
Backup and DR Vault Service Agent Service agent for backupdr.googleapis.com. [e-mail]	None
Backup for GKE Service Account Primary service agent for gkebackup.googleapis.com. [e-mail]	Backup for GKE Service Agent (roles/gkebackup.serviceAgent) Granted on the project.
Bare Metal Solution Service Account Primary service agent for baremetalsolution.googleapis.com. [e-mail]	Bare Metal Solution Service Agent (roles/baremetalsolution.serviceAgent) Granted on the project.
Batch Service Account Primary service agent for batch.googleapis.com. [e-mail]	Google Batch Service Agent (roles/batch.serviceAgent) Granted on the project.
Big Query Service Agent Service agent for bigquery.googleapis.com. [e-mail]	None
BigQuery Connection Delegation Service Agent Service agent for bigqueryconnection.googleapis.com. [e-mail] [e-mail]	None
BigQuery Connection Service Agent Primary service agent for bigqueryconnection.googleapis.com. [e-mail]	BigQuery Connection Service Agent (roles/bigqueryconnection.serviceAgent) Granted on the project.
BigQuery Continuous Query Service Agent Service agent for bigquery.googleapis.com. [e-mail]	BigQuery Continuous Query Service Agent (roles/bigquerycontinuousquery.serviceAgent) Granted on the project.
BigQuery Data Transfer Service Agent Primary service agent for bigquerydatatransfer.googleapis.com. [e-mail]	BigQuery Data Transfer Service Agent (roles/bigquerydatatransfer.serviceAgent) Granted on the project.
BigQuery Omni Service Agent Service agent for bigquery.googleapis.com. [e-mail]	BigQuery Omni Service Agent (roles/bigqueryomni.serviceAgent) Granted on the project.
BigQuery Resource Identity Service Account Service agent for bigquery.googleapis.com. [e-mail]	None
BigQuery Spark Connection Delegate Service Agent Service agent for bigqueryconnection.googleapis.com. [e-mail]	None
BigQuery Spark Service Agent Service agent for bigquery.googleapis.com. [e-mail]	BigQuery Spark Service Agent (roles/bigqueryspark.serviceAgent) Granted on the project.
Binary Authorization Service Agent Primary service agent for binaryauthorization.googleapis.com. [e-mail]	Binary Authorization Service Agent (roles/binaryauthorization.serviceAgent) Granted on the project.
Blockchain Node Engine Service Account Primary service agent for blockchainnodeengine.googleapis.com. [e-mail]	Blockchain Node Engine Service Agent (roles/blockchainnodeengine.serviceAgent) Granted on the project.
Bundles Service Agent Service agent for integrations.googleapis.com. [e-mail]	None
Chronicle Security Validation Service Account Service agent for chronicle.googleapis.com. [e-mail]	None
Chronicle Service Account Primary service agent for chronicle.googleapis.com. [e-mail]	Chronicle Service Agent (roles/chronicle.serviceAgent) Granted on the project.
Chronicle Soar Service Agent Service agent for chronicle.googleapis.com. [e-mail]	None
Cloud AI Platform Notebooks Service Account Primary service agent for notebooks.googleapis.com. [e-mail]	AI Platform Notebooks Service Agent (roles/notebooks.serviceAgent) Granted on the project.
Cloud API Gateway Management Plane Service Account Service agent for apigateway.googleapis.com. [e-mail]	Cloud API Gateway Management Service Agent (roles/apigateway_management.serviceAgent) Granted on the project.
Cloud API Gateway Service Account Service agent for apigateway.googleapis.com. [e-mail]	Cloud API Gateway Service Agent (roles/apigateway.serviceAgent) Granted on the project.
Cloud Asset Effective Policy Service Agent Service agent for cloudasset.googleapis.com. [e-mail]	None
Cloud Asset Other Cloud Config Service Agent Service agent for cloudasset.googleapis.com. [e-mail]	None
Cloud Asset Service Agent Primary service agent for cloudasset.googleapis.com. [e-mail]	Cloud Asset Service Agent (roles/cloudasset.serviceAgent) Granted on the project.
Cloud Bigtable Service Agent Primary service agent for bigtableadmin.googleapis.com. [e-mail]	None
Cloud Build Service Agent Service agent for cloudbuild.googleapis.com. [e-mail]	Cloud Build Service Agent (roles/cloudbuild.serviceAgent) Granted on the project.
Cloud Certificate Manager Service Account Primary service agent for certificatemanager.googleapis.com. [e-mail]	Certificate Manager Service Agent (roles/certificatemanager.serviceAgent) Granted on the project.
Cloud Composer Service Agent Primary service agent for composer.googleapis.com. [e-mail]	Cloud Composer API Service Agent (roles/composer.serviceAgent) Granted on the project.
Cloud Controls Partner Service Agent Service agent for cloudcontrolspartner.googleapis.com. [e-mail]	None
Cloud DNS Service Account Primary service agent for dns.googleapis.com. [e-mail]	Cloud DNS Service Agent (roles/dns.serviceAgent) Granted on the project.
Cloud Data Fusion Service Account Primary service agent for datafusion.googleapis.com. [e-mail]	Cloud Data Fusion API Service Agent (roles/datafusion.serviceAgent) Granted on the project.
Cloud Data Loss Prevention Service Agent Primary service agent for dlp.googleapis.com. [e-mail]	DLP API Service Agent (roles/dlp.serviceAgent) Granted on the project.
Cloud Database Migration Service Account Primary service agent for datamigration.googleapis.com. [e-mail]	Database Migration Service Agent (roles/datamigration.serviceAgent) Granted on the project.
Cloud Dataflow Service Account Primary service agent for dataflow.googleapis.com. [e-mail]	Cloud Dataflow Service Agent (roles/dataflow.serviceAgent) Granted on the project.
Cloud Dataplex Service Account Primary service agent for dataplex.googleapis.com. [e-mail]	Cloud Dataplex Service Agent (roles/dataplex.serviceAgent) Granted on the project.
Cloud Datastream Service Account Primary service agent for datastream.googleapis.com. [e-mail]	Datastream Service Agent (roles/datastream.serviceAgent) Granted on the project.
Cloud Deploy Service Account Primary service agent for clouddeploy.googleapis.com. [e-mail]	Cloud Deploy Service Agent (roles/clouddeploy.serviceAgent) Granted on the project.
Cloud Endpoints Service Agent Primary service agent for endpoints.googleapis.com. [e-mail]	Cloud Endpoints Service Agent (roles/endpoints.serviceAgent) Granted on the project.
Cloud File Storage Service Account Primary service agent for file.googleapis.com. [e-mail]	Cloud Filestore Service Agent (roles/file.serviceAgent) Granted on the project.
Cloud Firestore Service Agent Primary service agent for firestore.googleapis.com. [e-mail]	Firestore Service Agent (roles/firestore.serviceAgent) Granted on the project.
Cloud Healthcare Service Agent Primary service agent for healthcare.googleapis.com. [e-mail]	Healthcare Service Agent (roles/healthcare.serviceAgent) Granted on the project.
Cloud Identity Platform Service Agent Primary service agent for identitytoolkit.googleapis.com. [e-mail]	Identity Platform Service Agent (roles/identitytoolkit.serviceAgent) Granted on the project.
Cloud KMS Organization Service Agent Service agent for cloudkms.googleapis.com. [e-mail]	None
Cloud KMS Service Agent Service agent for cloudkms.googleapis.com. [e-mail]	Cloud KMS Service Agent (roles/cloudkms.serviceAgent) Granted on the project.
Cloud Life Sciences Service Agent Primary service agent for lifesciences.googleapis.com. [e-mail]	Cloud Life Sciences Service Agent (roles/lifesciences.serviceAgent) Granted on the project.
Cloud Logging Service Account Service agent for logging.googleapis.com. [e-mail]	Cloud Logging Service Agent (roles/logging.serviceAgent) Granted on the project.
Cloud Logging Service Agent Service agent for logging.googleapis.com. For the folder: [e-mail] For the organization: [e-mail]	None
Cloud Managed Identities Service Agent Primary service agent for managedidentities.googleapis.com. [e-mail]	Cloud Managed Identities Service Agent (roles/managedidentities.serviceAgent) Granted on the project.
Cloud Memorystore Memcache Service Agent Primary service agent for memcache.googleapis.com. [e-mail]	Cloud Memorystore Memcached Service Agent (roles/memcache.serviceAgent) Granted on the project.
Cloud Memorystore Redis Service Agent Primary service agent for redis.googleapis.com. [e-mail]	Cloud Memorystore Redis Service Agent (roles/redis.serviceAgent) Granted on the project.
Cloud Migration Center Service Account Primary service agent for migrationcenter.googleapis.com. [e-mail]	Migration Center Service Agent (roles/migrationcenter.serviceAgent) Granted on the project.
Cloud Network Management Service Account Primary service agent for networkmanagement.googleapis.com. [e-mail]	GCP Network Management Service Agent (roles/networkmanagement.serviceAgent) Granted on the project.
Cloud Notebook Security Scanner Service Agent Primary service agent for notebooksecurityscanner.googleapis.com. [e-mail]	None
Cloud Notebook Security Scanner Service Agent Service agent for notebooksecurityscanner.googleapis.com. For the project: [e-mail] For the organization: [e-mail]	None
Cloud Optimization Service Agent Primary service agent for cloudoptimization.googleapis.com. [e-mail]	Cloud Optimization Service Agent (roles/cloudoptimization.serviceAgent) Granted on the project.
Cloud Optimization Service Agent Primary service agent for routeoptimization.googleapis.com. [e-mail]	Route Optimization Service Agent (roles/routeoptimization.serviceAgent) Granted on the project.
Cloud Pub/Sub Service Account Primary service agent for pubsub.googleapis.com. [e-mail]	Cloud Pub/Sub Service Agent (roles/pubsub.serviceAgent) Granted on the project.
Cloud Resource Manager Service Agent Service agent for cloudresourcemanager.googleapis.com. [e-mail]	None
Cloud Risk Manager Service Agent Service agent for dlp.googleapis.com. [e-mail]	None
Cloud SQL Service Account Primary service agent for sqladmin.googleapis.com. [e-mail]	Cloud SQL Service Agent (roles/cloudsql.serviceAgent) Granted on the project.
Cloud SQL Service Agent Service agent for sqladmin.googleapis.com. For the project: [e-mail] For the folder: [e-mail] For the organization: [e-mail]	None
Cloud Scheduler Service Account Primary service agent for cloudscheduler.googleapis.com. [e-mail]	Cloud Scheduler Service Agent (roles/cloudscheduler.serviceAgent) Granted on the project.
Cloud Security Command Center Notification Service Account Service agent for securitycenter.googleapis.com. [e-mail]	Security Center Notification Service Agent (roles/securitycenter.notificationServiceAgent) Granted on the project.
Cloud Security Command Center Service Account Service agent for securitycenter.googleapis.com. [e-mail]	Security Center Service Agent (roles/securitycenter.serviceAgent) Granted on the project.
Cloud Security Command Center Service Agent Service agent for securitycenter.googleapis.com. [e-mail]	None
Cloud Spanner Production Service Account Primary service agent for spanner.googleapis.com. [e-mail]	Cloud Spanner API Service Agent (roles/spanner.serviceAgent) Granted on the project.
Cloud Storage for Firebase Service Agent Primary service agent for firebasestorage.googleapis.com. [e-mail]	Cloud Storage for Firebase Service Agent (roles/firebasestorage.serviceAgent) Granted on the project.
Cloud Tasks Service Account Primary service agent for cloudtasks.googleapis.com. [e-mail]	Cloud Tasks Service Agent (roles/cloudtasks.serviceAgent) Granted on the project.
Cloud Trace Service Account Primary service agent for cloudtrace.googleapis.com. [e-mail]	None
Cloud Translation Service Agent Primary service agent for translate.googleapis.com. [e-mail]	Cloud Translation API Service Agent (roles/cloudtranslate.serviceAgent) Granted on the project.
Cloud VM Migration Service Account Primary service agent for vmmigration.googleapis.com. [e-mail]	VM Migration Service Agent (roles/vmmigration.serviceAgent) Granted on the project.
Cloud Web Security Scanner Service Agent Primary service agent for websecurityscanner.googleapis.com. [e-mail]	Cloud Web Security Scanner Service Agent (roles/websecurityscanner.serviceAgent) Granted on the project.
Cloud Workflows Service Agent Primary service agent for workflows.googleapis.com. [e-mail]	Cloud Workflows Service Agent (roles/workflows.serviceAgent) Granted on the project.
Compute Engine Service Agent Service agent for compute.googleapis.com. [e-mail]	Compute Engine Service Agent (roles/compute.serviceAgent) Granted on the project.
Compute Usage Export Service Agent Service agent for compute.googleapis.com. [e-mail]	None
Config Delivery Service Account Primary service agent for configdelivery.googleapis.com. [e-mail]	Config Delivery Service Agent (roles/configdelivery.serviceAgent) Granted on the project.
Connectors Service Account Primary service agent for connectors.googleapis.com. [e-mail]	Connectors Platform Service Agent (roles/connectors.serviceAgent) Granted on the project.
Contact Center AI Insights Service Account Primary service agent for contactcenterinsights.googleapis.com. [e-mail]	Contact Center AI Insights Service Agent (roles/contactcenterinsights.serviceAgent) Granted on the project.
Contact Center AI Insights Service Account for CMEK (prod) Service agent for contactcenterinsights.googleapis.com. [e-mail]	None
Contact Center AI Platform Service Account Primary service agent for contactcenteraiplatform.googleapis.com. [e-mail]	None
Contact Center AI shared Service Account for CMEK (prod) Service agent for contactcenterinsights.googleapis.com. [e-mail]	None
Container Analysis Service Agent Primary service agent for containeranalysis.googleapis.com. [e-mail]	Container Analysis Service Agent (roles/containeranalysis.ServiceAgent) Granted on the project.
Container Scanning Service Agent Primary service agent for containerscanning.googleapis.com. [e-mail]	Container Scanner Service Agent (roles/containerscanning.ServiceAgent) Granted on the project.
Container Security Service Agent Primary service agent for containersecurity.googleapis.com. [e-mail]	None
Container Threat Detection Service Agent Primary service agent for containerthreatdetection.googleapis.com. [e-mail]	Container Threat Detection Service Agent (roles/containerthreatdetection.serviceAgent) Granted on the project.
Container Threat Detection Service Agent Service agent for containerthreatdetection.googleapis.com. For the project: [e-mail] For the organization: [e-mail]	None
Content Warehouse Service Account Primary service agent for contentwarehouse.googleapis.com. [e-mail]	Content Warehouse Service Agent (roles/contentwarehouse.serviceAgent) Granted on the project.
Data Connectors Service Account Primary service agent for dataconnectors.googleapis.com. [e-mail]	Data Connectors Service Agent (roles/dataconnectors.serviceAgent) Granted on the project.
Data Labeling Service Account Primary service agent for datalabeling.googleapis.com. [e-mail]	Data Labeling Service Agent (roles/datalabeling.serviceAgent) Granted on the project.
Data Pipelines Service Agent Primary service agent for datapipelines.googleapis.com. [e-mail]	Datapipelines Service Agent (roles/datapipelines.serviceAgent) Granted on the project.
Data Studio Service Account Primary service agent for datastudio.googleapis.com. [e-mail]	Data Studio Service Agent (roles/datastudio.serviceAgent) Granted on the project.
Dataform Service Account Primary service agent for dataform.googleapis.com. [e-mail]	Dataform Service Agent (roles/dataform.serviceAgent) Granted on the project.
Dataproc Metastore Service Account Primary service agent for metastore.googleapis.com. [e-mail]	Dataproc Metastore Service Agent (roles/metastore.serviceAgent) Granted on the project.
Deprecated Monitoring Service Account Service agent for monitoring.googleapis.com. [e-mail]	None
Developer Connect Service Account Primary service agent for developerconnect.googleapis.com. [e-mail]	None
Dialogflow Service Account for CMEK (prod) Service agent for dialogflow.googleapis.com. [e-mail]	None
Dialogflow Service Agent Primary service agent for dialogflow.googleapis.com. [e-mail]	Dialogflow Service Agent (roles/dialogflow.serviceAgent) Granted on the project.
Discovery Engine Service Account Primary service agent for discoveryengine.googleapis.com. [e-mail]	Discovery Engine Service Agent (roles/discoveryengine.serviceAgent) Granted on the project.
Document AI Warehouse CMEK Infra Spanner Service Account Service agent for contentwarehouse.googleapis.com. [e-mail]	None
DocumentAI Core Service Agent Primary service agent for documentai.googleapis.com. [e-mail]	DocumentAI Core Service Agent (roles/documentaicore.serviceAgent) Granted on the project.
Edge Container Cluster Service Agent Service agent for edgecontainer.googleapis.com. [e-mail]	Edge Container Cluster Service Agent (roles/edgecontainer.clusterServiceAgent) Granted on the project.
Edge Container GCR Service Agent Service agent for edgecontainer.googleapis.com. [e-mail]	None
Edge Container Service Agent Primary service agent for edgecontainer.googleapis.com. [e-mail]	Edge Container Service Agent (roles/edgecontainer.serviceAgent) Granted on the project.
Enterprise Knowledge Graph Service Agent Primary service agent for enterpriseknowledgegraph.googleapis.com. [e-mail]	Enterprise Knowledge Graph Service Agent (roles/enterpriseknowledgegraph.serviceAgent) Granted on the project.
Eventarc Service Agent Primary service agent for eventarc.googleapis.com. [e-mail]	Eventarc Service Agent (roles/eventarc.serviceAgent) Granted on the project.
External Key Management Service Service Account Primary service agent for cloudkms.googleapis.com. [e-mail]	None
Firebase App Check Service Account Primary service agent for firebaseappcheck.googleapis.com. [e-mail]	Firebase App Check Service Agent (roles/firebaseappcheck.serviceAgent) Granted on the project.
Firebase App Hosting Service Account Primary service agent for firebaseapphosting.googleapis.com. [e-mail]	Firebase App Hosting Service Agent (roles/firebaseapphosting.serviceAgent) Granted on the project.
Firebase Data Connect Service Account Primary service agent for firebasedataconnect.googleapis.com. [e-mail]	Firebase Data Connect Service Agent (roles/firebasedataconnect.serviceAgent) Granted on the project.
Firebase Extensions Service Agent Primary service agent for firebaseextensions.googleapis.com. [e-mail]	Firebase Extensions API Service Agent (roles/firebasemods.serviceAgent) Granted on the project.
Firebase Machine Learning Service Account Primary service agent for firebaseml.googleapis.com. [e-mail]	Firebase Machine Learning Service Agent (roles/firebaseml.serviceAgent) Granted on the project.
Firebase Management Service Agent Service agent for firebase.googleapis.com. [e-mail]	Firebase Service Management Service Agent (roles/firebase.managementServiceAgent) Granted on the project.
Firebase Realtime Database Service Agent Primary service agent for firebasedatabase.googleapis.com. [e-mail]	Firebase Realtime Database Service Agent (roles/firebasedatabase.serviceAgent) Granted on the project.
Firebase Rules Service Agent Primary service agent for firebaserules.googleapis.com. [e-mail]	Firebase Rules System (roles/firebaserules.system) Granted on the project.
Firewall Insights Service Account Primary service agent for firewallinsights.googleapis.com. [e-mail]	Cloud Firewall Insights Service Agent (roles/firewallinsights.serviceAgent) Granted on the project.
G Suite Add-ons Service Account Primary service agent for gsuiteaddons.googleapis.com. [e-mail]	None
GKE Dataplane V2 Service Account Primary service agent for gkedataplanev2.googleapis.com. [e-mail]	None
GKE Hub API Service Account Primary service agent for gkehub.googleapis.com. [e-mail]	GKE Hub Service Agent (roles/gkehub.serviceAgent) Granted on the project.
Gemini for Google Cloud Service Agent Primary service agent for cloudaicompanion.googleapis.com. [e-mail]	Cloud AI Companion Service Agent (roles/cloudaicompanion.serviceAgent) Granted on the project.
Gke On-Prem Service Account Primary service agent for gkeonprem.googleapis.com. [e-mail]	GKE On-Prem Service Agent (roles/gkeonprem.serviceAgent) Granted on the project.
Google APIs Service Agent Service agent used internally by Google Cloud. [e-mail]	Editor (roles/editor) Granted on the project.
Google Cloud Dataproc Resource Manager Node Service Agent Primary service agent for dataprocrm.googleapis.com. [e-mail]	Dataproc Resource Manager Node Service Agent (roles/dataprocrm.nodeServiceAgent) Granted on the project.
Google Cloud Dataproc Service Agent Primary service agent for dataproc.googleapis.com. [e-mail]	Dataproc Service Agent (roles/dataproc.serviceAgent) Granted on the project.
Google Cloud Functions Service Agent Primary service agent for cloudfunctions.googleapis.com. [e-mail]	Cloud Functions Service Agent (roles/cloudfunctions.serviceAgent) Granted on the project.
Google Cloud ML Engine Service Agent Primary service agent for ml.googleapis.com. [e-mail]	AI Platform Service Agent (roles/ml.serviceAgent) Granted on the project.
Google Cloud NetApp Volumes Service Account Primary service agent for netapp.googleapis.com. [e-mail]	None
Google Cloud OS Config Rollout Service Agent Service agent for osconfig.googleapis.com. [e-mail]	None
Google Cloud OS Config Rollout Service Agent Service agent for osconfig.googleapis.com. For the folder: [e-mail] For the organization: [e-mail]	None
Google Cloud OS Config Service Agent Primary service agent for osconfig.googleapis.com. [e-mail]	Cloud OS Config Service Agent (roles/osconfig.serviceAgent) Granted on the project.
Google Cloud OS Config Service Agent Service agent for osconfig.googleapis.com. For the folder: [e-mail] For the organization: [e-mail]	None
Google Cloud Run Service Agent Primary service agent for run.googleapis.com. [e-mail]	Cloud Run Service Agent (roles/run.serviceAgent) Granted on the project.
Google Cloud Service Extensions Service Account Service agent for networkservices.googleapis.com. [e-mail]	None
Google Container Registry Service Agent Primary service agent for containerregistry.googleapis.com. [e-mail]	Container Registry Service Agent (roles/containerregistry.ServiceAgent) Granted on the project.
Google Storage Service Agent Service agent for storage.googleapis.com. [e-mail]	None
IAP Service Account Primary service agent for iap.googleapis.com. [e-mail]	None
Identity Pool Resource Identity Service agent for iam.googleapis.com. [e-mail]	None
Infrastructure Manager Service Account Primary service agent for config.googleapis.com. [e-mail]	Infrastructure Manager Service Agent (roles/cloudconfig.serviceAgent) Granted on the project.
Integrated Vulnerability Scanner Service Account Service agent for securitycenter.googleapis.com. [e-mail]	None
Internal Chronicle Spanner Service Account Service agent for chronicle.googleapis.com. [e-mail]	None
Internal Cloud Firestore Spanner Service Agent Service agent for firestore.googleapis.com. [e-mail]	None
Issuer Switch Service Account Primary service agent for issuerswitch.googleapis.com. [e-mail]	None
KRM API Hosting Service Account Service agent for krmapihosting.googleapis.com. [e-mail]	KRM API Hosting Service Agent (roles/krmapihosting.serviceAgent) Granted on the project.
KRM API Hosting Service Account Service agent for krmapihosting.googleapis.com. [e-mail]	KRM API Hosting AnthosApiEndpoint Service Agent (roles/krmapihosting.anthosApiEndpointServiceAgent) Granted on the project.
Kubernetes Engine Node Service Agent Service agent for container.googleapis.com. [e-mail]	Kubernetes Engine Node Service Agent (roles/container.nodeServiceAgent) Granted on the project.
Kubernetes Engine Service Agent Primary service agent for container.googleapis.com. [e-mail]	Kubernetes Engine Service Agent (roles/container.serviceAgent) Granted on the project.
Legacy Cloud Build service account Service agent for cloudbuild.googleapis.com. [e-mail]	Cloud Build Service Account (roles/cloudbuild.builds.builder) Granted on the project.
Livestream Service Account Primary service agent for livestream.googleapis.com. [e-mail]	Live Stream Service Agent (roles/livestream.serviceAgent) Granted on the project.
Logging Service Agent Service agent for logging.googleapis.com. For the project: [e-mail] For the folder: [e-mail] For the organization: [e-mail]	None
Looker Service Account Primary service agent for looker.googleapis.com. [e-mail]	Looker Service Agent (roles/looker.serviceAgent) Granted on the project.
Managed Flink Service Agent Primary service agent for managedflink.googleapis.com. [e-mail]	Managed Flink Service Agent (roles/managedflink.serviceAgent) Granted on the project.
Managed Kafka Service Account Primary service agent for managedkafka.googleapis.com. [e-mail]	Managed Kafka Service Agent (roles/managedkafka.serviceAgent) Granted on the project.
Memorystore Service Agent Primary service agent for memorystore.googleapis.com. [e-mail]	Cloud Memorystore Service Agent (roles/memorystore.serviceAgent) Granted on the project.
Mesh Config Service Account Primary service agent for meshconfig.googleapis.com. [e-mail]	Mesh Config Service Agent (roles/meshconfig.serviceAgent) Granted on the project.
Monitoring Service Account Primary service agent for monitoring.googleapis.com. [e-mail]	Monitoring Service Agent (roles/monitoring.notificationServiceAgent) Granted on the project.
Multi Cluster Ingress Service Account Primary service agent for multiclusteringress.googleapis.com. [e-mail]	Multi Cluster Ingress Service Agent (roles/multiclusteringress.serviceAgent) Granted on the project.
Multi cluster metering Service Account Primary service agent for multiclustermetering.googleapis.com. [e-mail]	Multi-cluster metering Service Agent (roles/multiclustermetering.serviceAgent) Granted on the project.
Multi-cluster Service Discovery Service Account Primary service agent for multiclusterservicediscovery.googleapis.com. [e-mail]	Multi-Cluster Service Discovery Service Agent (roles/multiclusterservicediscovery.serviceAgent) Granted on the project.
Network Actions Service Account Service agent for networkservices.googleapis.com. [e-mail]	Network Actions Service Agent (roles/networkactions.serviceAgent) Granted on the project.
Network Connectivity Service Account Primary service agent for networkconnectivity.googleapis.com. [e-mail]	Network Connectivity Service Agent (roles/networkconnectivity.serviceAgent) Granted on the project.
Network Security Service Account Primary service agent for networksecurity.googleapis.com. [e-mail]	None
On-Demand Scanning Service Account Primary service agent for ondemandscanning.googleapis.com. [e-mail]	On-Demand Scanning Service Agent (roles/ondemandscanning.serviceAgent) Granted on the project.
Oracle Database@Google Cloud Service Account Primary service agent for oracledatabase.googleapis.com. [e-mail]	Oracle Database@Google Cloud Service Agent (roles/oci.serviceAgent) Granted on the project.
Parallelstore Service Agent Primary service agent for parallelstore.googleapis.com. [e-mail]	Parallelstore Service Agent (roles/parallelstore.serviceAgent) Granted on the project.
Playbook Runner Service Agent Service agent for integrations.googleapis.com. For the project: [e-mail] For the folder: [e-mail] For the organization: [e-mail]	None
Policy Remediator Service Agent (prod) Service agent for policyremediator.googleapis.com. [e-mail]	None
Private CA Service Account Primary service agent for privateca.googleapis.com. [e-mail]	None
Privileged Access Manager Service Agent Service agent for privilegedaccessmanager.googleapis.com. For the project: [e-mail] For the folder: [e-mail] For the organization: [e-mail]	None
Pub/Sub Lite Service Account Primary service agent for pubsublite.googleapis.com. [e-mail]	Pub/Sub Lite Service Agent (roles/pubsublite.serviceAgent) Granted on the project.
Rapid Migration Assessment Service Account Primary service agent for rapidmigrationassessment.googleapis.com. [e-mail]	RMA Service Agent (roles/rapidmigrationassessment.serviceAgent) Granted on the project.
Remote Build Execution Service Agent Primary service agent for remotebuildexecution.googleapis.com. [e-mail]	None
Remote Build Execution Service Agent Service agent for remotebuildexecution.googleapis.com. [e-mail]	Remote Build Execution Service Agent (roles/remotebuildexecution.serviceAgent) Granted on the project.
Remote Build Execution Service Agent Service agent for remotebuildexecution.googleapis.com. [e-mail]	Remote Build Execution Service Agent (roles/remotebuildexecution.serviceAgent) Granted on the project.
Retail Service Account Primary service agent for retail.googleapis.com. [e-mail]	Retail Service Agent (roles/retail.serviceAgent) Granted on the project.
Secret Manager Service Account Primary service agent for secretmanager.googleapis.com. [e-mail]	None
Secure Source Manager Service Account Primary service agent for securesourcemanager.googleapis.com. [e-mail]	Secure Source Manager Service Agent (roles/securesourcemanager.serviceAgent) Granted on the project.
Secure Web Proxy Service Account Service agent for networkservices.googleapis.com. [e-mail]	None
Serverless Integrations Service Account Primary service agent for runapps.googleapis.com. [e-mail]	Serverless Integrations Service Agent (roles/runapps.serviceAgent) Granted on the project.
Serverless VPC Access Service Agent Primary service agent for vpcaccess.googleapis.com. [e-mail]	Serverless VPC Access Service Agent (roles/vpcaccess.serviceAgent) Granted on the project.
Service Agent Manager Service agent used internally by Google Cloud. [e-mail]	None
Service Consumer Management Service Agent Primary service agent for serviceconsumermanagement.googleapis.com. [e-mail]	None
Service Directory Service Account Primary service agent for servicedirectory.googleapis.com. [e-mail]	Service Directory Service Agent (roles/servicedirectory.serviceAgent) Granted on the project.
Service Networking Service Agent Primary service agent for servicenetworking.googleapis.com. [e-mail]	Service Networking Service Agent (roles/servicenetworking.serviceAgent) Granted on the project.
Spectrum SAS Service Account Primary service agent for sasportal.googleapis.com. [e-mail]	Spectrum SAS Service Agent (roles/spectrumsas.serviceAgent) Granted on the project.
Speech-to-Text Service Account Primary service agent for speech.googleapis.com. [e-mail]	Cloud Speech-to-Text Service Agent (roles/speech.serviceAgent) Granted on the project.
Storage Insights Service Account Primary service agent for storageinsights.googleapis.com. [e-mail]	StorageInsights Service Agent (roles/storageinsights.serviceAgent) Granted on the project.
Storage Transfer Service Service Agent Service agent for storagetransfer.googleapis.com. [e-mail]	None
Stream Service Account Primary service agent for stream.googleapis.com. [e-mail]	Stream Service Agent (roles/stream.serviceAgent) Granted on the project.
TPU Service Agent Primary service agent for tpu.googleapis.com. [e-mail]	Cloud TPU API Service Agent (roles/tpu.serviceAgent) Granted on the project.
TPU Service Agent (v2) Service agent for tpu.googleapis.com. [e-mail]	Cloud TPU V2 API Service Agent (roles/cloudtpu.serviceAgent) Granted on the project.
Transcoder Service Account Primary service agent for transcoder.googleapis.com. [e-mail]	Transcoder Service Agent (roles/transcoder.serviceAgent) Granted on the project.
Transfer Appliance Service Account Primary service agent for transferappliance.googleapis.com. [e-mail]	None
VMwareEngine Service Account Primary service agent for vmwareengine.googleapis.com. [e-mail]	VMware Engine Service Agent (roles/vmwareengine.serviceAgent) Granted on the project.
Vertex AI Ancillary Secure Fine Tuning Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI User (roles/aiplatform.user) Granted on the project.
Vertex AI Batch Prediction Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Batch Prediction Service Agent (roles/aiplatform.batchPredictionServiceAgent) Granted on the project.
Vertex AI Colab Service Account Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Colab Service Agent (roles/aiplatform.colabServiceAgent) Granted on the project.
Vertex AI Extension Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Extension Service Agent (roles/aiplatform.extensionServiceAgent) Granted on the project.
Vertex AI Extension Service Agent for Custom Code Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Extension Custom Code Service Agent (roles/aiplatform.extensionCustomCodeServiceAgent) Granted on the project.
Vertex AI Model Monitoring Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Model Monitoring Service Agent (roles/aiplatform.modelMonitoringServiceAgent) Granted on the project.
Vertex AI Notebook Service Account Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Notebook Service Agent (roles/aiplatform.notebookServiceAgent) Granted on the project.
Vertex AI Online Prediction Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	None
Vertex AI Secure Fine Tuning Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI Tuning Service Agent (roles/aiplatform.tuningServiceAgent) Granted on the project.
Vertex AI in Firebase Service Account Primary service agent for firebasevertexai.googleapis.com. [e-mail]	Firebase Machine Learning Service Agent (roles/firebaseml.serviceAgent) Granted on the project.
Vertex Agent Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	None
Vertex RAG Data Service Agent Service agent for aiplatform.googleapis.com. [e-mail]	Vertex AI RAG Data Service Agent (roles/aiplatform.ragServiceAgent) Granted on the project.
Virtual Machine Threat Detection Service Account Service agent for securitycenter.googleapis.com. [e-mail]	None
Vision AI Service Account Primary service agent for visionai.googleapis.com. [e-mail]	Cloud Vision AI Service Agent (roles/visionai.serviceAgent) Granted on the project.
Workload Manager Service Account Primary service agent for workloadmanager.googleapis.com. [e-mail]	Workload Manager Service Agent (roles/workloadmanager.serviceAgent) Granted on the project.
Workstations Service Account Primary service agent for workstations.googleapis.com. [e-mail]	Workstations Service Agent (roles/workstations.serviceAgent) Granted on the project.
Workstations VM Default Service Account Service agent for workstations.googleapis.com. [e-mail]	None