Google Cloud IAM Roles

Basic roles such as Owner, Editor, and Viewer are broad, predefined roles contain Google-managed permission sets, and custom roles let an administrator select a narrower set of permissions. Google recommends checking the permission reference before granting access because a role controls what a principal can do on cloud resources. [Google IAM permissions reference](https://cloud.google.com/iam/docs/permissions-reference)

Google's Vertex AI Agent Engine setup documentation identifies Vertex AI User, `roles/aiplatform.user`, as a role that can provide the needed project access. Deployment may also require `roles/iam.serviceAccountUser` so the deploying person can attach the chosen service account. [Vertex AI setup](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/set-up)

Grant the runtime permissions to the agent identity or service account that actually calls Google Cloud, and grant the human only the permissions needed to deploy or manage it. Avoid giving an agent Owner or Editor when a narrower role such as `roles/aiplatform.user` is enough. [Vertex AI setup](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/set-up)

Yes, IAM bindings can be applied at resource levels such as an organization, folder, project, or individual resource, with broader bindings inherited by lower levels. Use the narrowest scope that supports the task so a Vertex AI service account does not gain unrelated access across the organization.