Fine-Grained Access Controls for Gemini Enterprise Apps

Google Cloud has rolled out updated access control features for Gemini Enterprise, providing administrators with more refined control over user permissions for individual applications. This enhancement, documented on May 26, 2026, moves beyond broad project-level Identity and Access Management (IAM) settings to allow for app-specific access configurations. The new functionality empowers Gemini Enterprise admins to leverage the `getIamPolicy` and `setIamPolicy` API methods to retrieve and modify the IAM policies for their applications. This allows for the precise granting or revoking of user access to particular Gemini Enterprise apps. The documentation emphasizes the importance of fetching the existing policy before making updates to prevent accidental overwrites of current permissions. This granular control is particularly beneficial for organizations with complex structures or stringent data governance requirements. It enables admins to restrict user access to specific apps within the same Google Cloud project, ensuring that permissions are tightly aligned with departmental needs and data silos. The `Gemini Enterprise User` role (`roles/discoveryengine.agentspaceUser`) is central to granting direct user access at the app level. Google notes that changes to IAM policies may experience propagation delays, taking several minutes to fully apply across the system.