Skip to main content

Connect Google Cloud

Waxell discovers and governs the agents your organization runs on the Gemini Enterprise Agent Platform — Vertex AI Agent Engine (code agents), Conversational Agents (Dialogflow CX), and Gemini Enterprise assistants — across your Google Cloud project or organization.

The recommended path is keyless: you grant Waxell's service account a read-only role, and Waxell authenticates with its own short-lived tokens. No service-account key is ever downloaded, pasted, or stored.

What Waxell can see​

Read-only inventory and activity:

  • Agent inventory — Vertex AI Agent Engine (reasoningEngines), Conversational Agents (Dialogflow CX), and Gemini Enterprise apps.
  • Activity — Vertex agent activity pulled from Cloud Logging (aiplatform + reasoning-engine logs), turned into governed runs attributed to each agent — with no redeploy of your agents.

Choose whichever grant fits your access model — both are keyless.

Option A — grant Waxell's service account a viewer role (simplest).

  1. In Waxell, go to Governance → Agent Discovery → Connect and choose Gemini Enterprise Agent Platform. Waxell shows you its discovery service account address.
  2. In Google Cloud IAM, grant that service account roles/aiplatform.viewer (add roles/dialogflow.reader and Discovery Engine viewer to include those surfaces) at the project — or organization/folder — level.
  3. Back in Waxell, enter your GCP project (and region), leave the key blank, and Sync.

Granting at the org or folder level covers every project in one action — ideal for large estates.

Option B — impersonation.

  1. Grant Waxell's discovery service account roles/iam.serviceAccountTokenCreator on a service account in your project that already holds the viewer roles above.
  2. In the connector, enter that service account's email in "SA to impersonate", plus your project and region, and Sync.

Waxell exchanges its own identity for a short-lived token scoped to your project. Nothing long-lived is stored.

Prefer to provide a key?​

If your policy requires it, you can paste a service-account key JSON (for a service account with roles/aiplatform.viewer) instead of the keyless grant. Choose the key path on the connector, paste the JSON — it's encrypted at rest and never displayed again — and Sync. Keyless is recommended because there's no key to rotate or leak.

Least privilege​

Discovery needs only viewer-level reads:

  • roles/aiplatform.viewer — Agent Engine inventory
  • roles/dialogflow.reader — Conversational Agents
  • Discovery Engine viewer — Gemini Enterprise apps
  • Cloud Logging read — agent activity

Grant only the surfaces you want discovered; a surface Waxell can't read is simply skipped, never fatal.

What you get​

Discovered Google agents appear in your cross-cloud fleet under Governance → Agent Discovery, alongside your Microsoft and AWS agents, and their activity flows onto the Executions screen. Every governance policy you author applies to them.

Revoking access​

Remove the IAM role grant (or the token-creator grant) from Waxell's service account, or delete the connection in Waxell. Either ends access immediately.