Guide · Agent skill
How to use the Assured Workloads Basics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The assured-workloads-basics skill is an agent skill from google/skills that lets an AI agent help you create, list, inspect, update and delete Google Cloud Assured Workloads V1 compliant folders. It is written for cloud engineers and administrators who work with regulated or government workloads. After reading this guide you will know what the skill does, how to install it, how to ask for it in plain language, and what it needs before it can run.
Assured Workloads Basicsgoogle/skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, upload it under Settings → Capabilities → Skills instead.
- 2Install the prerequisites. Install the Google Cloud SDK and the three Python packages, then authenticate gcloud and Application Default Credentials.
- 3Set the admin project. Set your admin project as the gcloud default and as the quota project, then enable the Assured Workloads API on it.
- 4Confirm your IAM roles. Check that you hold the organization-level roles the skill lists, including roles/assuredworkloads.admin and roles/billing.user.
- 5Ask in plain language. Describe the workload you want, naming the compliance regime and location, so the agent can start its checklist.
- 6Review and approve. Read the validated parameters and warnings, then explicitly confirm any create, update or delete action.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and helper files that an AI agent can load when a task matches the skill's description. This skill is licensed under Apache-2.0 and is scoped to Google Cloud Assured Workloads V1.
Once installed, the agent can provision compliant folders for regimes such as FedRAMP, DoD IL2/IL4/IL5, ITAR, CJIS, Healthcare, Sovereign Controls by Partners, and Regional Data Boundaries. It can also allowlist compliant services, manage CMEK settings, and list, inspect, update or delete existing workloads.
- Creates Assured Workloads V1 workloads with gcloud assured workloads create
- Lists and describes existing workloads
- Updates and deletes workloads, with explicit confirmation first
- Runs bundled helper scripts to validate parameters and diagnose common errors
Install the skill from the ZIP download
Download the skill ZIP from this page. Then unzip it into one of two locations: your personal skills folder at ~/.claude/skills/, or a project-specific .claude/skills/ folder inside the project you are working in.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the .claude/skills/ folder of your project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Check the requirements before you start
The skill runs commands and scripts, so you need the tools and access in place first. The skill's Step 0 lists five prerequisites that the agent checks before running Assured Workloads operations.
Install the Google Cloud SDK (gcloud) and the Python libraries the skill uses. Then authenticate both gcloud and Application Default Credentials, set your admin project as the default, and enable the Assured Workloads API.
- Google Cloud SDK (gcloud) and Python 3
- Python packages: google-cloud-assured-workloads, google-api-python-client and google-auth
- gcloud login and Application Default Credentials authentication
- An Organization ID, a billing account ID and an admin project with the Assured Workloads API (assuredworkloads.googleapis.com) enabled
- IAM roles such as roles/assuredworkloads.admin, roles/billing.user and roles/resourcemanager.organizationViewer
pip install "google-cloud-assured-workloads>=1.0,<2" "google-api-python-client>=2.0,<3" "google-auth>=2.0,<3"
gcloud services enable assuredworkloads.googleapis.com --project={admin_project_id}Trigger the skill with natural requests
You do not need to type a special command. Describe what you want in plain language that mentions Assured Workloads, and the agent will match the request to the skill. The skill's description lists the compliance regimes and actions it covers, so naming a regime such as FedRAMP or CJIS helps.
If you want to build a compliant environment, say what you need, the regime and the location, and the agent will walk through its checklist before changing anything.
- "Use Assured Workloads to create a FedRAMP Moderate folder in us-central1 for my agency."
- "List the Assured Workloads workloads in my organization."
- "Show me the details of this Assured Workloads workload and its compliance settings."
- "Update the labels on my CJIS Assured Workloads folder."
- "Set up a US Data Boundary workload for my EU team."
Understand the confirmation workflow
The skill follows a fixed checklist: it verifies prerequisites and IDs, validates parameters with a bundled script, asks for your confirmation before any change, and only then runs gcloud or Python client commands. Read-only actions such as list and describe can run right after validation. Create, update, delete and apply actions always wait for your explicit approval.
Expect the agent to ask for IDs rather than guess them. The skill forbids inventing organization, billing account, folder, project or workload IDs, so provide them or let the agent look them up with the commands it is allowed to run.
- Read-only: list and describe run immediately after validation
- Mutating: create, update, delete, apply, and folder or project deletes need your confirmation
- Billing account: if you omit it, the agent lists open billing accounts or asks you for the ID
Know the safety and network behaviour
This skill runs scripts and uses the network. Its helper scripts validate parameters, restrict allowed resources, manage workload updates and diagnose errors. Mutating actions carry real cost and compliance consequences, so review each proposed command before you approve it.
Every gcloud command the agent runs is prefixed with a telemetry attribution variable that identifies the skill and does not persist between commands. The skill also tells the agent to use regional API endpoints rather than the global one.
- Scripts: validate_params.py, restrict_allowed_resources.py, manage_workload_updates.py, diagnose_error.py
- Assured Workloads V1 does not support --location=global; use a regional or multi-regional location for your regime
- The skill never runs gcloud compliance-manager commands for V1 workloads
- Creation fails without organization-level IAM roles and billing access
CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:assured-workloads-basics)" gcloud <command> [flags]Tips for getting reliable results
Give the agent the compliance regime, the location, the organization ID and the billing account in your first message. Clear inputs reduce back-and-forth and make the validation step more useful.
For regimes that are not listed in the reference file, or for assessments of existing environments, ask for something else. The skill is not meant for brownfield assessments or custom frameworks and points those requests to other skills.
- Name the regime exactly, for example FEDRAMP_MODERATE or REGIONAL_DATA_BOUNDARY, and check the regimes reference for valid locations
- Read the warnings from validate_params.py before approving a create
- Use the list and describe actions first to see what already exists
What people use it for
- Create a FedRAMP or DoD IL-level folder for a government team and confirm each setting before creation.
- List and inspect existing Assured Workloads workloads to audit which compliance regimes are in use.
- Set up a free-tier Regional Data Boundary, such as an EU Data Boundary, for a team with data-residency needs.
- Diagnose a failed Assured Workloads command with the bundled error diagnosis script.
- Update workload labels or configuration with a reviewed, confirmation-based change.
Frequently asked questions
How do I install the assured-workloads-basics skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
What do I need before using the Assured Workloads skill?
You need the Google Cloud SDK, Python 3 with three client packages, gcloud and Application Default Credentials authentication, an Organization ID, a billing account ID, and an admin project with the Assured Workloads API enabled. You also need IAM roles such as roles/assuredworkloads.admin and roles/billing.user.
Is the assured-workloads-basics skill free?
The skill is licensed under Apache-2.0. The source does not state pricing for Google Cloud usage, and the skill itself warns that mutating actions carry real cost, so check Google Cloud billing for the resources you create.
Can the skill work outside Google Cloud?
No. The skill is scoped to Google Cloud Assured Workloads V1. It is not meant for non-Google Cloud environments or non-compliant folders.
Which tasks should use a different skill instead?
The skill says brownfield assessments and custom compliance frameworks should use other skills, namely assuredworkloads-environment-assessor or assuredworkloads-frameworks-*.
Why does the agent keep asking me to confirm?
The skill requires explicit user confirmation before any mutating or destructive command, including create, update, delete, and apply. Read-only list and describe commands can run without it after validation.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a cloud engineer or administrator who needs a guided, confirmation-based way to create, list, inspect or update Assured Workloads V1 compliant folders for regulated work. Pick something else if you need a brownfield assessment, a custom compliance framework, or you do not hold organization-level IAM roles and billing access.
Download the skill