Google’s IAM Helper is an orchestration layer over Policy Intelligence and Privileged Access Manager. High-level workflows are packaged through the open Agent Skills standard and described as working with Gemini CLI, Gemini Cloud Assist, ADK, Claude Code and Cursor.
The important boundary is below the prompt. Backend IAM endpoints perform hierarchy traversal, group expansion and policy evaluation across allow and deny policies, Policy Troubleshooter, Policy Analyzer and Policy Simulator. Diagnostics and simulations are read-only and may run automatically; policy changes pause for human confirmation according to configurable risk tiers.
The policy-simulator workflow is described as plan, simulate, analyze and apply, checking changes against 90 days of historical access logs before mutation. Privileged-access workflows use requested, approved, audited and time-bounded credentials that revoke automatically at task end. Google’s examples of rapid diagnosis and hours saved are scenarios rather than disclosed benchmarks. Google Cloud.