Google has released Data Agent Kit to general availability, taking the open-source plugin out of its summer preview and making it free for any developer to install into third-party coding agents. The toolkit connects AI assistants to more than fifteen Google Data Cloud services and includes both automated best-practice guidance and live schema access, running in editors like Cursor, VS Code, and Claude Code. With this launch, Google adds support for BigQuery Graph, Bigtable, and Managed Service for Apache Spark, expanding the range of cloud services an agent can manipulate directly.
The kit ships as two distinct layers of control, and the difference becomes critical when agents touch production systems. One layer consists of 37 skills published under Apache 2.0 license, versioned at 1.1.0 as of October 13, with guidance on tasks like optimizing BigQuery SQL or designing Bigtable row keys. Among those skills sits accidental-data-loss-prevention, which instructs agents to halt and obtain explicit user consent before executing irreversible commands like DROP TABLE, TRUNCATE, DELETE statements without WHERE clauses, production bucket deletions, project deletions via gcloud, or KMS key destruction. The second layer operates through MCP servers that expose live schema and tools, authenticated through IAM rather than per-agent configuration. Operators can enforce read-only access by running the agent as a read-only service account or by applying an IAM deny policy that blocks any MCP tool where the attribute tool.isReadOnly is false, using the condition api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false at the organization, folder, or project level.
Product manager Arun Nair and developer advocate Jeff Nelson, who authored the launch announcement, position the toolkit as filling a gap that exists by default: agents can generate well-formed SQL but lack knowledge of "which tables exist, how they're partitioned, which ones your team trusts, or why last night's job failed." The accidental-data-loss-prevention skill opens with the instruction "STOP AND VERIFY" and directs the agent that it "MUST obtain explicit user consent" before proceeding with any action that can't be reversed, according to the skill's published description. That guardrail, however, is advisory—the agent is asked to comply but isn't technically prevented from ignoring it.
The distinction between advice and enforcement matters in production environments, where the IAM-based controls offer harder boundaries. Three constraints accompany those controls: blocked tools still appear in the tools/list output, meaning agents see capabilities they can't invoke and discover the restriction only when they attempt execution; the controls apply exclusively to Google Cloud MCP servers and nothing beyond them; and the resource.service and tool.name attributes are accessible only through gcloud, not the console. AI solutions architect Amel Habira reviewed the documentation and expressed encouragement, highlighting the short-lived credentials, the read-only attribute, and warnings before agents execute notebook cells, writing that combining these measures with branching and time travel on the Iceberg side could enable "containment at both the access layer and the data layer." AI engineer Ankit Dongre at viaSocket pushed the production boundary further, noting that permission scope alone doesn't address repeat-safe execution challenges like what happens when an agent retries a write after a timeout or when the schema changes mid-run, adding that "a first-class result should carry an idempotency key plus commit status and rollbackability"—features Data Agent Kit's tool results don't include today.
Google authorizes per tool using the IAM language customers already have in place and propagates the user's identity so row and column security continues to apply, a different approach from Microsoft's Agent 365 integration with Azure API Management, which keeps governance intent in a Microsoft 365 admin surface and enforces it at a gateway where the application key is "gateway-scoped" and reaches every model and tool. Timon Knapp, founder of self-hosted workload automation vendor Conductral, advised caution regardless of architecture, writing that connecting agents to live environments like Airflow is powerful but recommending teams start with read access and suggestions, letting a human confirm anything that changes a schedule or reruns a job, since "a clean audit trail makes it much easier to give the agent more rights later." The toolkit itself costs nothing beyond the Google Cloud services an agent consumes, and the skills repository is available on GitHub for teams to fork and customize. The hard question isn't whether agents can be granted production access, but whether the controls around that access can evolve as quickly as the ways agents fail in unexpected scenarios. Organizations adopting these tools will need to decide whether advisory guardrails and IAM enforcement together create enough containment, or whether production safety requires architectures that treat agent actions as proposals rather than executed commands until a deeper contract around idempotency and rollback becomes standard.