Even as sophisticated new zero-day exploits continue to surface, most cybersecurity incidents still trace back to the same root cause: an attacker finding and exploiting a basic, easily preventable cloud misconfiguration, according to Google Cloud.

Organization Policy Service is designed to secure resource configurations and establish security guardrails across the Google Cloud resource hierarchy. It offers a catalog of more than 100 predefined policies covering common cloud governance needs, alongside Custom Organization Policy for setting boundaries with granular control over resources.

To help platform and security teams author, audit, and scale guardrails more quickly and simply, Google announced the general availability of its Organization Policy Model Context Protocol (MCP) server and natural-language constraint authoring powered by Gemini.

Managing Organization Policy with agents

Instead of requiring administrators to manually parse complex hierarchy chains, the Organization Policy MCP server provides tools that let autonomous agents and pipelines interact directly with Organization Policy. With it, agents can assist administrators with posture audits, drift detection, and exemption management. Key capabilities include:

  • Constraint discovery: tools such as ListConstraints and GetCustomConstraint let agents determine which guardrails apply to a project, folder, or organization.
  • Policy evaluation: the GetEffectivePolicy tool computes the effective policy after accounting for hierarchy inheritance and tag-based conditions, which can be used to check whether a configuration change would be compliant.
  • Manage policy: CreatePolicy and CreateCustomConstraint let platform teams manage guardrails through conversational workflows.

As an example, a preferred coding agent can be combined with the Organization Policy MCP tools to build a custom dashboard that visualizes the constraints applied to an organization and identifies the folders and projects that have been exempted from a policy. Teams can also build custom agents and skills to streamline Organization Policy management.

Custom dashboard created with Organization Policy MCP tools displaying enforced constraints
Custom dashboard created with Organization Policy MCP tools displaying enforced constraints — Source
Drilldown view for visualizing enforced constraints and identifying exemptions with Organization Policy MCP tools
Drilldown view for visualizing enforced constraints and identifying exemptions with Organization Policy MCP tools — Source

Simplifying custom constraint authoring with Gemini

Although the Organization Policy constraint catalog ships with built-in managed constraints for common use cases, every organization has its own architectural standards. Custom Organization Policy lets customers express those standards as custom constraints and enforce them across supported services.

Traditionally, administrators wrote these rules in common expression language (CEL), which demanded a strong understanding of Google Cloud resource schemas. Administrators can now author custom Organization Policy in natural language through a Gemini prompt.

For example, Gemini can be prompted to require the use of agent-identity in Agent Runtime, to require that all agents deployed to Agent Runtime use an approved Agent Gateway, and to prevent users from disabling auto-upgrades on GKE, with custom constraints refined conversationally.

To support safe deployments, Gemini can also generate compliant and non-compliant test resource configurations, allowing policies to be tested and validated in dry-run mode before a constraint is enforced.

For targeted examples, the sample custom constraints library from Google Cloud Professional Services offers pre-authored custom constraint samples based on CIS and PCI standards. Custom constraints are supported across a wide range of Google Cloud services, including core AI and compute services such as Agent Runtime, Agent Search, and Agent Studio on the Gemini platform, as well as Cloud Run and Google Kubernetes Engine.

Build faster, with confidence

Google describes Organization Policy as proactive cloud governance for resource configurations on Google Cloud: it lets administrators enforce critical security guardrails so engineering teams can build and deploy quickly and securely. With a growing catalog of built-in guardrails, autonomous tools for administrators, and the ability to tailor custom constraints across Google Cloud services, the company says Organization Policy gives enterprises the control they need to scale safely.