角色与权限

本页面列出了 Agent Registry 的 IAM 角色和权限。

向将在注册表中管理或查看智能体的用户或群组授予适当的 Agent Registry IAM 角色。如需授予 角色，您可以使用控制台中的 Google Cloud IAM 页面或 Google Cloud CLI。如需查看详细说明，请参阅 管理对项目、文件夹和组织的访问权限。

Agent Registry 角色

下表介绍了 Agent Registry IAM 角色及其典型职责：

注意 ：仅向需要管理注册表的权限的受信任管理员授予 Agent Registry API Admin (roles/agentregistry.admin) 或 Agent Registry API Editor (roles/agentregistry.editor) 角色，并避免直接向智能体授予这些角色。这些角色包含创建、删除和更新服务的权限， 包括修改关键智能体元数据和 工具注释 ，例如 readOnlyHint 或 destructiveHint。如果编排器使用修改后的工具，对元数据和注释的恶意更改可能会导致意外的破坏性后果。此外，拥有这些权限的智能体可以明确地将恶意第三方智能体注册到注册表中。

角色	说明	用途
Agent Registry API Admin	执行所有操作，包括手动注册智能体和更新 元数据。	注册和管理智能体和 MCP 服务器。 更新工具定义和端点。
Agent Registry API Editor	拥有对 Agent Registry 资源的编辑权限。	注册和管理智能体和 MCP 服务器。 更新工具定义和端点。
Agent Registry API Viewer	查看智能体、工具及其属性。	发现可用的智能体和 MCP 服务器。 查看 A2A 技能、独立技能和用于集成的端点。
Agent Registry User	创建、更新和删除技能和技能修订版本。	管理 Agent Registry 中智能体的独立技能。 对技能修订版本进行版本控制，并集中管理技能的活跃状态。

Agent Registry 权限

下表列出了每个 Agent Registry IAM 角色拥有的权限：

Agent Registry API Admin Agent Registry API Editor Agent Registry API Viewer Agent Registry User 清除所有

Agent Registry API Admin ^Beta 版 (roles/agentregistry.admin) 拥有对 Agent Registry API 资源的完整访问权限。	agentregistry.* agentregistry.agents.get agentregistry.agents.list agentregistry.agents.search agentregistry.bindings.create agentregistry.bindings.delete agentregistry.bindings.fetchAvailable agentregistry.bindings.get agentregistry.bindings.list agentregistry.bindings.update agentregistry.endpoints.get agentregistry.endpoints.list agentregistry.locations.get agentregistry.locations.list agentregistry.mcpServers.get agentregistry.mcpServers.list agentregistry.mcpServers.search agentregistry.operations.cancel agentregistry.operations.delete agentregistry.operations.get agentregistry.operations.list agentregistry.publishers.get agentregistry.publishers.list agentregistry.services.create agentregistry.services.delete agentregistry.services.get agentregistry.services.list agentregistry.services.update agentregistry.skillRevisions.create agentregistry.skillRevisions.delete agentregistry.skillRevisions.get agentregistry.skillRevisions.list agentregistry.skills.create agentregistry.skills.delete agentregistry.skills.get agentregistry.skills.list agentregistry.skills.search agentregistry.skills.update
Agent Registry API Editor ^Beta 版 (roles/agentregistry.editor) 拥有对 Agent Registry API 资源的编辑权限。	agentregistry.agents.* agentregistry.agents.get agentregistry.agents.list agentregistry.agents.search agentregistry.bindings.fetchAvailable agentregistry.bindings.get agentregistry.bindings.list agentregistry.endpoints.* agentregistry.endpoints.get agentregistry.endpoints.list agentregistry.locations.* agentregistry.locations.get agentregistry.locations.list agentregistry.mcpServers.* agentregistry.mcpServers.get agentregistry.mcpServers.list agentregistry.mcpServers.search agentregistry.operations.* agentregistry.operations.cancel agentregistry.operations.delete agentregistry.operations.get agentregistry.operations.list agentregistry.publishers.* agentregistry.publishers.get agentregistry.publishers.list agentregistry.services.* agentregistry.services.create agentregistry.services.delete agentregistry.services.get agentregistry.services.list agentregistry.services.update agentregistry.skillRevisions.* agentregistry.skillRevisions.create agentregistry.skillRevisions.delete agentregistry.skillRevisions.get agentregistry.skillRevisions.list agentregistry.skills.* agentregistry.skills.create agentregistry.skills.delete agentregistry.skills.get agentregistry.skills.list agentregistry.skills.search agentregistry.skills.update
Agent Registry API Viewer ^Beta 版 (roles/agentregistry.viewer) 拥有对 Agent Registry API 资源的只读权限。	agentregistry.agents.* agentregistry.agents.get agentregistry.agents.list agentregistry.agents.search agentregistry.bindings.fetchAvailable agentregistry.bindings.get agentregistry.bindings.list agentregistry.endpoints.* agentregistry.endpoints.get agentregistry.endpoints.list agentregistry.locations.* agentregistry.locations.get agentregistry.locations.list agentregistry.mcpServers.* agentregistry.mcpServers.get agentregistry.mcpServers.list agentregistry.mcpServers.search agentregistry.operations.get agentregistry.operations.list agentregistry.publishers.* agentregistry.publishers.get agentregistry.publishers.list agentregistry.services.get agentregistry.services.list agentregistry.skillRevisions.get agentregistry.skillRevisions.list agentregistry.skills.get agentregistry.skills.list agentregistry.skills.search
Agent Registry User ^Beta 版 (roles/agentregistry.user) 创建、更新和删除技能和技能修订版本。	agentregistry.agents.* agentregistry.agents.get agentregistry.agents.list agentregistry.agents.search agentregistry.bindings.fetchAvailable agentregistry.bindings.get agentregistry.bindings.list agentregistry.endpoints.* agentregistry.endpoints.get agentregistry.endpoints.list agentregistry.locations.* agentregistry.locations.get agentregistry.locations.list agentregistry.mcpServers.* agentregistry.mcpServers.get agentregistry.mcpServers.list agentregistry.mcpServers.search agentregistry.operations.get agentregistry.operations.list agentregistry.publishers.* agentregistry.publishers.get agentregistry.publishers.list agentregistry.services.get agentregistry.services.list agentregistry.skillRevisions.* agentregistry.skillRevisions.create agentregistry.skillRevisions.delete agentregistry.skillRevisions.get agentregistry.skillRevisions.list agentregistry.skills.* agentregistry.skills.create agentregistry.skills.delete agentregistry.skills.get agentregistry.skills.list agentregistry.skills.search agentregistry.skills.update

如需详细了解 IAM 权限，请参阅 查找合适的预定义角色 和 IAM 角色和权限索引。