# Which IAM role do Applane builders need? > One: roles/aiplatform.user on the project, granted to the builders Google Group. No service accounts, no keys, no other bindings. Source: https://docs.applane.dev/gcp-admins/iam/ **Who:** GCP admin **Time:** 2 minutes Builders call Vertex AI with their own Google account. For that, each of them needs `roles/aiplatform.user` on the project. Grant it once to the builders group, and from then on adding a builder means adding them to the group. ```bash gcloud projects add-iam-policy-binding \ --member=group:applane-builders@ \ --role=roles/aiplatform.user ``` Group membership changes reach IAM within a few minutes. The group is created by the Workspace admin: [Accounts and groups](https://docs.applane.dev/workspace-admins/accounts-and-groups/). ## No service accounts, anywhere Applane creates no service account, no key, and no other IAM binding. There is nothing for Applane to hold, because every call is made from the builder's browser with the builder's own token. If a security review asks what Applane can do in your project, the answer is: nothing; it has no identity there. The only exception is [Infrastructure Manager](https://docs.applane.dev/gcp-admins/setup/infrastructure-manager/), which needs its own service account to run Terraform. That account is Google's deployment runner, not Applane's. ## What `roles/aiplatform.user` allows Calling models, reading model metadata, and using Vertex AI endpoints in this project. It does not allow reading other projects, creating resources, or changing IAM. A builder's token is only as powerful as the builder's own IAM, so for a typical employee this role is the only GCP right they hold. ## Context caching permissions The extension keeps its system prompt in a Vertex AI context cache during a build turn instead of re-sending it every round, which is where most of the saving on [model cost](https://docs.applane.dev/gcp-admins/model-cost/) comes from. That needs four permissions on the project: ```text aiplatform.cachedContents.create aiplatform.cachedContents.get aiplatform.cachedContents.list aiplatform.cachedContents.delete ``` `roles/aiplatform.user` already includes all four, so the grant above is enough. If your company grants a custom role instead, add those four plus `aiplatform.endpoints.predict`, which the model call itself needs. Without them the extension still works. Every turn is then billed at the full input rate, and the Costs panel in the extension shows "Context cache: off". ## Verify ```bash gcloud projects get-iam-policy \ --flatten=bindings --filter='bindings.role=roles/aiplatform.user' \ --format='value(bindings.members)' ``` Expect `group:applane-builders@` in the output. The [setup checker](https://docs.applane.dev/gcp-admins/verify/) tests the same binding.