How to use the Google Cloud PAM Access Helper agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and optional files that an AI agent loads when a task matches its description. This skill covers the PAM lifecycle: creating and changing entitlements, requesting a time-limited grant, and approving or denying pending grants.

PAM replaces permanent or ambient IAM role assignments with on-demand, time-bound, and audited access. An entitlement defines the access scope, the eligible requesters and the approvers. A grant is a short-lived request made against an entitlement to activate its IAM roles.

• Admins: help draft entitlement configuration files from a template.
• Requesters: help request a time-limited access grant.
• Approvers: help review, approve or deny pending grant requests.
• Read-only lookups: run included scripts that list entitlements or find ones you are eligible to request.

Install the skill in Claude

Download the ZIP from the skill's page on this site and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Prepare Google Cloud before you start

The skill does not work on its own. You need the Google Cloud SDK (gcloud) with the PAM commands available, a Google Cloud account with PAM roles, a Bash shell for the included scripts, and the project, folder or organization IDs you want to target.

For creating entitlements, the source says you need roles/privilegedaccessmanager.admin, plus IAM admin rights on the target scope. Organizations need roles/iam.securityAdmin, folders need roles/resourcemanager.folderAdmin, and projects need roles/resourcemanager.projectIamAdmin. Listing and describing entitlements needs roles/privilegedaccessmanager.viewer.

Requesters and approvers do not need explicit IAM roles. You become a requester by being listed in an entitlement's eligibleUsers, and an approver by being listed in its approvalWorkflow approvers.

Ask for what you need in plain language

The skill loads when your request matches its description. Use clear verbs and name the object: create, read, update or delete a PAM entitlement; request temporary access; or approve or deny a pending grant. Include the target scope and entitlement ID when you have them.

The skill is not meant for permanent IAM policy bindings, troubleshooting IAM permission errors, or general resource provisioning. Ask for those in a separate request.

• "Draft a PAM entitlement for roles/compute.viewer on project my-project, with approval from db-lead@my-company.com."
• "I need 8 hours of temporary access to project my-project to investigate an incident."
• "Show me the PAM entitlements I am eligible to request in folder 123456."
• "List pending PAM grants I can approve in organization 987654."

Understand how it protects changes

The skill separates read-only checks from changes. Read-only commands such as list, describe and search run without asking you. Create, update, delete, approve, deny and revoke actions are shown to you as a plain-text summary, and the agent waits for an explicit Yes or No before running them.

Each gcloud command the skill runs is tagged with a usage attribution environment variable that identifies only the skill and its version. The skill also sets a default maximum request duration of 4 hours (14400s) when you do not specify one.

• Modifying actions require your Yes/No confirmation.
• Read-only lookups run without confirmation.
• If an error is ambiguous, the agent stops and shows the stderr output.
• Default maxRequestDuration when unspecified: 14400s (4 hours).

Safety notes: scripts and network access

This skill runs scripts and uses the network. The included scripts are scripts/list_entitlements_hierarchy.sh and scripts/search_eligible_entitlements.sh. They are read-only lookups that call gcloud against your Google Cloud resources.

Because the host environment asks you to approve each shell call, the skill batches read-only commands into one script where possible. Review any command before you approve it, and only run the skill with an account you are comfortable using.

• Included scripts: list_entitlements_hierarchy.sh and search_eligible_entitlements.sh
• Network: yes, calls go to Google Cloud through gcloud
• Skill cannot grant access itself; access comes only from PAM and your IAM setup