Google Cloud's IAM Helper gives coding agents skills to debug 403s and request just-in-time access
Announced Oct 26, four open Agent Skills (iam-helper-for-troubleshooting, -policy-management, -policy-simulator, -privileged-access-management) sit on read-only Google-managed MCP servers so Gemini CLI, Claude Code, Cursor and ADK agents can trace a 403, simulate a policy change against 90 days of access logs, or request a time-bound PAM grant. Diagnostics run on their own, but any policy change pauses for human approval, and risky bindings like allUsers or roles/owner get flagged; install with npx skills add google/skills.