Which IAM role do Applane builders need?

Who

GCP admin

Time

2 minutes

Builders call Vertex AI with their own Google account. For that, each of them needs roles/aiplatform.user on the project. Grant it once to the builders group, and from then on adding a builder means adding them to the group.

gcloud projects add-iam-policy-binding <GCP_PROJECT_ID> \
  --member=group:applane-builders@<YOUR_DOMAIN> \
  --role=roles/aiplatform.user

Group membership changes reach IAM within a few minutes. The group is created by the Workspace admin: Accounts and groups.

No service accounts, anywhere

Applane creates no service account, no key, and no other IAM binding. There is nothing for Applane to hold, because every call is made from the builder’s browser with the builder’s own token. If a security review asks what Applane can do in your project, the answer is: nothing; it has no identity there.

The only exception is Infrastructure Manager, which needs its own service account to run Terraform. That account is Google’s deployment runner, not Applane’s.

What roles/aiplatform.user allows

Calling models, reading model metadata, and using Vertex AI endpoints in this project. It does not allow reading other projects, creating resources, or changing IAM. A builder’s token is only as powerful as the builder’s own IAM, so for a typical employee this role is the only GCP right they hold.

Context caching permissions

The extension keeps its system prompt in a Vertex AI context cache during a build turn instead of re-sending it every round, which is where most of the saving on model cost comes from. That needs four permissions on the project:

aiplatform.cachedContents.create
aiplatform.cachedContents.get
aiplatform.cachedContents.list
aiplatform.cachedContents.delete

roles/aiplatform.user already includes all four, so the grant above is enough. If your company grants a custom role instead, add those four plus aiplatform.endpoints.predict, which the model call itself needs.

Without them the extension still works. Every turn is then billed at the full input rate, and the Costs panel in the extension shows “Context cache: off”.

Verify

gcloud projects get-iam-policy <GCP_PROJECT_ID> \
  --flatten=bindings --filter='bindings.role=roles/aiplatform.user' \
  --format='value(bindings.members)'

Expect group:applane-builders@<YOUR_DOMAIN> in the output. The setup checker tests the same binding.