Powering agentic cloud governance: What's new in Organization Policy

Google Cloud announced general availability of its Organization Policy Model Context Protocol (MCP) server and Gemini-powered natural-language constraint authoring for Organization Policy Service. The MCP server exposes tools including ListConstraints, GetCustomConstraint, GetEffectivePolicy, CreatePolicy and CreateCustomConstraint, letting autonomous agents and pipelines run posture audits, drift detection and exemption management, while administrators can now write custom constraints in natural language instead of common expression language (CEL) and generate compliant and non-compliant test configurations for dry-run validation. The service catalogs over 100 predefined policies for cloud governance, and Google Cloud Professional Services published a sample custom constraints library on GitHub.

Even as sophisticated, new zero-day exploits continue to emerge, most cybersecurity incidents still start from the same common sources: an attacker locating and exploiting a fundamental, easily preventable cloud misconfiguration. Organization Policy Service https://docs.cloud.google.com/organization-policy/overview can help you secure resource configurations and set up security guardrails across your Google Cloud resource hierarchy. Using a catalog of over 100 predefined policies for many common cloud governance needs, as well as Custom Organization Policy https://cloud.google.com/blog/products/identity-security/announcing-custom-org-policy-to-help-tailor-resource-guardrails-with-confidence?e=48754805 , you can more easily set up boundaries with granular control over resources. To help platform and security teams author, audit, and scale guardrails with greater speed and simplicity, we are introducing the general availability of our Organization Policy Model Context Protocol MCP server and natural-language constraint authoring powered by Gemini. Rather than forcing administrators to manually parse complex hierarchy chains, the Organization Policy MCP server https://docs.cloud.google.com/organization-policy/reference/mcp offers tools that allow autonomous agents and pipelines to interact directly with Organization Policy. Using the Organization Policy MCP server, agents can assist administrators with posture audits, drift detection, and exemption management. Key capabilities include: Constraint discovery : Tools like 'ListConstraints' and 'GetCustomConstraint' allow agents to understand the specific guardrails that apply to a project, folder, or organization. Policy evaluation : The 'GetEffectivePolicy' tool calculates the effective policy after considering hierarchy inheritance and tag-based conditions. You can use this to verify if a configuration change will be compliant. Manage policy : 'CreatePolicy' and 'CreateCustomConstraint' allow platform teams to manage guardrails via conversational workflows. For example, you can combine your preferred coding agent with the Organization Policy MCP tools to create a custom dashboard to visualize the constraints applied to an organization and identify the folders and projects in the organization that have been exempted from the policy. You can also build custom agents and skills to streamline managing Organization Policy. While the Organization Policy constraint catalog https://docs.cloud.google.com/organization-policy/reference/org-policy-constraints available constraints provides built-in managed constraints for common use cases, each organization has its own unique architectural standards. Custom Organization Policy https://docs.cloud.google.com/organization-policy/overview custom-constraints enables customers to express these standards as a custom constraint and enforce them across supported services. Traditionally, administrators would write these rules in common expression language CEL , which required a sharp understanding of Google Cloud resource schemas. Today, administrators can author custom Organization Policy in natural language through a Gemini prompt. For example, you can prompt Gemini to require the use of agent-identity in Agent Runtime https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/runtime?hl=ja , to require that all agents deployed to Agent Runtime use an approved Agent Gateway, and to prevent users from disabling auto-upgrades on GKE, and refine custom constraints conversationally. To help ensure safe deployments, Gemini can also generate compliant and non-compliant test resource configurations that can help you test policy and validate in dry-run mode before enforcing the constraint. For targeted examples, the sample custom constraints library https://github.com/GoogleCloudPlatform/professional-services/tree/main/tools/custom-organization-policy-library from Google Cloud Professional Services features pre-authored custom constraint samples based on CIS and PCI standards. Custom constraints https://docs.cloud.google.com/organization-policy/reference/custom-constraint-supported-services are supported on a wide range of Google Cloud services including core AI and compute services including Agent Runtime, Agent Search, and Agent Studio on Gemini platform, Cloud Run, and Google Kubernetes Engine. Organization Policy provides proactive cloud governance of resource configurations on Google Cloud. It lets administrators enforce critical security guardrails so engineering teams can build and deploy quickly and securely. With a growing catalog of built-in guardrails, autonomous tools for administrators, and the ability to tailor custom constraints across Google Cloud services, Organization Policy gives enterprises the control they need to scale safely. Explore the Organization Policy documentation https://docs.cloud.google.com/organization-policy/overview to learn more about resource governance in Google Cloud and set up your foundational guardrails.