Google 的 Data Agent Kit 正式发布，将智能体护栏拆分至技能与 IAM 之间

Google 最近正式推出了 Data Agent Kit，此前它在整个夏季都处于预览阶段。它免费、开源，还可以安装到 Google 并不拥有的编程代理中。它提供两种控制方式，而两者的区别在生产环境中至关重要。Google recently made Data Agent Kit generally available, moving it out of the preview it ran through the summer. It is free, it is open source, and it installs into coding agents Google does not own. It ships two kinds of control, and the difference matters in production.

Data Agent Kit 是一套 MCP 工具，可将智能体连接到 15 种以上 Google Data Cloud 服务；此外还包含由 Google 编写的技能，指导智能体掌握优化 BigQuery SQL 或设计 Bigtable 行键等实践。它可在 Antigravity、Claude Code、Codex、Cursor 和兼容 VS Code 的编辑器中运行，并预装于 Cloud Shell 和 Cloud Workstations 中。Data Agent Kit is a set of MCP tools connecting an agent to more than fifteen Google Data Cloud services, plus Google-authored skills that teach it practices like optimizing BigQuery SQL or designing Bigtable row keys. It runs in Antigravity, Claude Code, Codex, Cursor, and VS Code-compatible editors, and comes preinstalled in Cloud Shell and Cloud Workstations.

Data Agent Kit 由两个组件构成，位于编码代理与 Google Data Cloud 服务之间：提供最佳实践指导的技能，以及用于公开实时架构和工具的 MCP 服务器。（来源：Google 博客文章）Data Agent Kit sits between the coding agent and Google Data Cloud services as two components: skills carrying best-practice guidance and MCP servers exposing live schema and tools. (Source: Google Blog post)

随着正式版发布，该公司新增了 BigQuery Graph、Bigtable 和 Apache Spark 托管服务。撰写发布公告的产品经理 Arun Nair 和开发者倡导者 Jeff Nelson，将其定位为弥补智能体默认存在的一项短板：它们能写出不错的 SQL，却对“有哪些表、表是如何分区的、团队信任哪些表，或者昨晚的作业为何失败”一无所知。With the GA release, the company adds BigQuery Graph, Bigtable, and Managed Service for Apache Spark. Product manager Arun Nair and developer advocate Jeff Nelson, who wrote the launch post, pitch it at a gap agents have by default: they write good SQL but know nothing about "which tables exist, how they’re partitioned, which ones your team trusts, or why last night’s job failed."

该插件仓库包含 37 个采用 Apache 2.0 许可的技能，每个技能的 frontmatter 都将 Google 列为发布者。仓库采用规范的版本管理，1.0.0 版于 9 月 29 日发布，1.1.0 版于 10 月 13 日发布，因此团队可以固定使用特定版本。The plugin repository carries 37 skills under Apache 2.0, each with frontmatter naming Google as publisher. It is versioned properly, with 1.0.0 cut on September 29 and 1.1.0 on October 13, so teams can pin it.

这些技能中包括 accidental-data-loss-prevention，旨在防止代理破坏任何东西。它的描述以“停止并核实”开篇，并告知代理，在执行任何不可逆操作之前，“必须获得用户的明确同意”，列举的操作包括 DROP TABLE、TRUNCATE、缺少 WHERE 子句或使用 1=1 的 DELETE、删除生产存储桶中的数据、gcloud projects delete，以及销毁 KMS 密钥。操作流程是：暂停，说明影响，然后等待用户明确同意。Among those skills is accidental-data-loss-prevention, which exists to stop the agent destroying something. Its description opens "STOP AND VERIFY" and tells the agent it "MUST obtain explicit user consent" before anything irreversible, listing DROP TABLE, TRUNCATE, a DELETE missing a WHERE clause or using 1=1, storage deletions against production buckets, gcloud projects delete, and KMS key destruction. The procedure is halt, explain the impact, wait for affirmative consent.

那道护栏只是建议，智能体会被要求遵守它。第二道控制则不是。That guardrail is advice. The agent is asked to obey it. A second control is not.

在 LinkedIn 帖文中，有人问能否将只读调查与会修改基础设施的工具隔离开来。Nelson 回答说，这应在 IAM 层面处理，而不是针对每个智能体：让智能体通过模拟身份的方式以只读服务账户运行，或者使用“阻止任何 tool.isReadOnly 为 false 的 MCP 工具的 IAM 拒绝策略”。Asked in a LinkedIn post whether read-only investigation could be isolated from tools that modify infrastructure, Nelson answered that it is handled in IAM rather than per agent: run the agent as a read-only service account through impersonation, or use "an IAM deny policy that blocks any MCP tool where tool.isReadOnly is false."

文档给出了以下条件：The documentation gives the condition:

api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false

它拒绝 mcp.googleapis.com/tools.call 权限，并在组织、文件夹或项目级别生效。配套属性涵盖 resource.service 和 tool.name。It denies the mcp.googleapis.com/tools.call permission, and applies at the organization, folder, or project level. Companion attributes cover resource.service and tool.name.

它也带来了三个限制。被阻止的工具仍会显示在 tools/list 中，因此代理会看到自己无法使用的功能，只有在调用时才会发现这一点。这些控制仅适用于 Google Cloud MCP 服务器，不适用于其他任何对象。而 resource.service 和 tool.name 仅限于 gcloud，在控制台中并不存在。Three limits come with it. A blocked tool still appears in tools/list, so the agent sees capabilities it cannot use and finds out only on invocation. The controls cover Google Cloud MCP servers and nothing else. And resource.service and tool.name are gcloud only, absent from the console.

AI 解决方案架构师 Amel Habira 阅读了文档后深受鼓舞，他特别提到了短时有效的凭证、只读属性，以及代理执行笔记本单元格前的警告。他写道：Amel Habira, an AI solutions architect, read the documentation and came away encouraged, noting the short-lived credentials, the read-only attribute, and a warning before agents execute notebook cells. He wrote:

再结合 Iceberg 侧的分支和时间旅行功能，就可以设想在访问层和数据层都实现隔离。

Combine that with branching and time travel on the Iceberg side, and you can imagine containment at both the access layer and the data layer.

viaSocket 的 AI 工程师 Ankit Dongre 将界限进一步拓展：Ankit Dongre, an AI engineer at viaSocket, drew the boundary further out:

MCP 访问是容易的部分。生产环境的关键在于权限范围和可安全重复执行：当代理在超时后重试写入，或架构在运行过程中发生变化时，会发生什么？

MCP access is the easy part. The production boundary is permission scope plus repeat-safe execution: what happens when an agent retries a write after a timeout, or when the schema changes mid-run?

他补充说，IAM 和 dry run 涵盖了授权和预检，“但它们无法告知代理超时的写入操作是否已提交。完善的结果应包含幂等键、提交状态和可回滚性。”Data Agent Kit 的工具结果目前并不包含这些信息。IAM and dry runs cover authorization and preflight, he added, "but they do not tell the agent whether a timed-out write committed. A first-class result should carry an idempotency key plus commit status and rollbackability." Data Agent Kit’s tool results do not carry that today.

微软把这一决策放在了别处。其与 Azure API Management 的 Agent 365 集成目前处于公开预览阶段：治理意图保留在 Microsoft 365 管理界面中，并在网关处执行；而要逐个工具进行阻止，则需要使用预览层级，且应用密钥的作用范围是“网关级”，会触及每个模型和工具。Google 则使用客户已熟悉的 IAM 语言，按工具进行授权，并传递用户身份，以便应用行级和列级安全控制。Microsoft put that decision somewhere else. Its Agent 365 integration with Azure API Management, in public preview, keeps governance intent in a Microsoft 365 admin surface and enforces it at a gateway, where per-tool blocking requires a preview tier and the application key is "gateway-scoped", reaching every model and tool. Google authorizes per tool in the IAM language customers already use, and propagates the user’s identity so row and column security applies.

无论采用哪种方式，运维人员都在谨慎地安排顺序。自托管工作负载自动化供应商 Conductral 的创始人 Timon Knapp 写道：Operators are sequencing either way carefully. Timon Knapp, founder of the self-hosted workload automation vendor Conductral, wrote:

将智能体连接到 Airflow 这类实时环境非常有用。根据多年运行生产批处理任务的经验，我会先只开放读取权限并让智能体提供建议；任何会更改调度或重新运行作业的操作，都应由人工确认。清晰的审计记录能让之后逐步赋予智能体更多权限变得容易得多。

Connecting agents to live environments like Airflow is powerful. From running production batch for years I would start with read access and suggestions, and let a human confirm anything that changes a schedule or reruns a job. A clean audit trail makes it much easier to give the agent more rights later.

Data Agent Kit 除代理使用的 Google Cloud 服务费用外，不收取任何费用。相关技能托管在 GitHub 上，可供 fork。Data Agent Kit costs nothing beyond the Google Cloud services an agent uses. The skills are on GitHub and forkable.