תפקידים והרשאות של IAM

בדף הזה מוסבר איך אפשר לשלוט בגישה ל-API ובהרשאות למשאבי Gemini Enterprise באמצעות ניהול זהויות והרשאות גישה (IAM).

סקירה כללית

‫Google Cloud כולל את הממשק לניהול זהויות והרשאות גישה (IAM), שבאמצעותו אתם יכולים לתת גישה פרטנית יותר למשאבים ספציפיים ב- Google Cloud ולמנוע גישה לא רצויה למשאבים אחרים. בדף הזה מוסבר על התפקידים וההרשאות ב-IAM של Gemini Enterprise. למידע מפורט עלGoogle Cloud IAM, תוכלו לעיין במסמכי העזרה של IAM.

‫Gemini Enterprise מספק קבוצה של תפקידים מוגדרים מראש שנועדו לעזור לכם לשלוט בגישה למשאבים של Gemini Enterprise. אם התפקידים המוגדרים מראש לא מספקים את קבוצות ההרשאות שאתם צריכים, אתם יכולים גם ליצור תפקידים בהתאמה אישית. בנוסף, התפקידים הבסיסיים הישנים יותר (עריכה, צפייה ובעלים) עדיין זמינים לכם, אבל הם לא מספקים את אותה רמת שליטה מפורטת כמו התפקידים ב-Gemini Enterprise. בפרט, התפקידים הבסיסיים מספקים גישה למשאבים ב- Google Cloud ולא רק ל-Gemini Enterprise. מידע נוסף מופיע במאמר בנושא תפקידים בסיסיים.

תפקידים מוגדרים מראש

‫Gemini Enterprise מספק כמה תפקידים מוגדרים מראש שבהם אפשר להשתמש כדי להעניק הרשאות פרטניות יותר לחשבונות משתמשים. התפקיד שאתם מקצים לחשבון משתמש קובע אילו פעולות הוא יכול לבצע. חשבונות ראשיים יכולים להיות אנשים פרטיים, קבוצות או חשבונות שירות.

אתם יכולים להקצות לאותו חשבון משתמש כמה תפקידים, ואתם יכולים לשנות את התפקידים שהוקצו לחשבון משתמש בכל שלב, בתנאי שיש לכם את ההרשאות לעשות זאת.

התפקידים הרחבים יותר כוללים את התפקידים המוגדרים בצורה מצומצמת יותר. לדוגמה, התפקיד 'עריכה' ב-Discovery Engine כולל את כל ההרשאות של התפקיד 'צפייה' ב-Discovery Engine, בנוסף להרשאות של התפקיד 'עריכה' ב-Discovery Engine. באופן דומה, תפקיד האדמין ב-Gemini Enterprise כולל את כל ההרשאות של תפקיד העריכה ב-Discovery Engine, וגם הרשאות נוספות.

התפקידים הבסיסיים (בעלים, עריכה, צפייה) מספקים הרשאות ב- Google Cloud. התפקידים שספציפיים ל-Gemini Enterprise מספקים רק הרשאות ל-Gemini Enterprise, למעט ההרשאות הבאות Google Cloud, שנדרשות לשימוש כללי Google Cloud :

  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.services.list
  • serviceusage.services.get

בטבלה הבאה מפורטים תפקידי IAM ב-Gemini Enterprise, עם רשימה של כל ההרשאות שמשויכות לכל תפקיד.

תפקיד הרשאות

(roles/discoveryengine.agentspaceAdmin)

ההרשאה מעניקה גישת אדמין למשאבי Gemini Enterprise.

cloudaicompanion.aiDevToolsSettings.*

  • cloudaicompanion.aiDevToolsSettings.create
  • cloudaicompanion.aiDevToolsSettings.delete
  • cloudaicompanion.aiDevToolsSettings.get
  • cloudaicompanion.aiDevToolsSettings.list
  • cloudaicompanion.aiDevToolsSettings.update

cloudaicompanion.codeRepositoryIndexes.*

  • cloudaicompanion.codeRepositoryIndexes.create
  • cloudaicompanion.codeRepositoryIndexes.delete
  • cloudaicompanion.codeRepositoryIndexes.get
  • cloudaicompanion.codeRepositoryIndexes.list
  • cloudaicompanion.codeRepositoryIndexes.update

cloudaicompanion.codeToolsSettings.*

  • cloudaicompanion.codeToolsSettings.create
  • cloudaicompanion.codeToolsSettings.delete
  • cloudaicompanion.codeToolsSettings.get
  • cloudaicompanion.codeToolsSettings.list
  • cloudaicompanion.codeToolsSettings.update

cloudaicompanion.dataSharingWithGoogleSettings.*

  • cloudaicompanion.dataSharingWithGoogleSettings.create
  • cloudaicompanion.dataSharingWithGoogleSettings.delete
  • cloudaicompanion.dataSharingWithGoogleSettings.get
  • cloudaicompanion.dataSharingWithGoogleSettings.list
  • cloudaicompanion.dataSharingWithGoogleSettings.update

cloudaicompanion.geminiGcpEnablementSettings.*

  • cloudaicompanion.geminiGcpEnablementSettings.create
  • cloudaicompanion.geminiGcpEnablementSettings.delete
  • cloudaicompanion.geminiGcpEnablementSettings.get
  • cloudaicompanion.geminiGcpEnablementSettings.list
  • cloudaicompanion.geminiGcpEnablementSettings.update

cloudaicompanion.instances.queryEffectiveSetting

cloudaicompanion.instances.queryEffectiveSettingBindings

cloudaicompanion.loggingSettings.*

  • cloudaicompanion.loggingSettings.create
  • cloudaicompanion.loggingSettings.delete
  • cloudaicompanion.loggingSettings.get
  • cloudaicompanion.loggingSettings.list
  • cloudaicompanion.loggingSettings.update

cloudaicompanion.operations.*

  • cloudaicompanion.operations.cancel
  • cloudaicompanion.operations.delete
  • cloudaicompanion.operations.get
  • cloudaicompanion.operations.list

cloudaicompanion.releaseChannelSettings.*

  • cloudaicompanion.releaseChannelSettings.create
  • cloudaicompanion.releaseChannelSettings.delete
  • cloudaicompanion.releaseChannelSettings.get
  • cloudaicompanion.releaseChannelSettings.list
  • cloudaicompanion.releaseChannelSettings.update

cloudaicompanion.repositoryGroups.create

cloudaicompanion.repositoryGroups.delete

cloudaicompanion.repositoryGroups.get

cloudaicompanion.repositoryGroups.getIamPolicy

cloudaicompanion.repositoryGroups.list

cloudaicompanion.repositoryGroups.setIamPolicy

cloudaicompanion.repositoryGroups.update

cloudaicompanion.settingBindings.*

  • cloudaicompanion.settingBindings.aiDevToolsSettingsCreate
  • cloudaicompanion.settingBindings.aiDevToolsSettingsDelete
  • cloudaicompanion.settingBindings.aiDevToolsSettingsGet
  • cloudaicompanion.settingBindings.aiDevToolsSettingsList
  • cloudaicompanion.settingBindings.aiDevToolsSettingsUpdate
  • cloudaicompanion.settingBindings.aiDevToolsSettingsUse
  • cloudaicompanion.settingBindings.codeToolsSettingsCreate
  • cloudaicompanion.settingBindings.codeToolsSettingsDelete
  • cloudaicompanion.settingBindings.codeToolsSettingsGet
  • cloudaicompanion.settingBindings.codeToolsSettingsList
  • cloudaicompanion.settingBindings.codeToolsSettingsUpdate
  • cloudaicompanion.settingBindings.codeToolsSettingsUse
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsCreate
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsDelete
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsGet
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsList
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUpdate
  • cloudaicompanion.settingBindings.dataSharingWithGoogleSettingsUse
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsCreate
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsDelete
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsGet
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsList
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUpdate
  • cloudaicompanion.settingBindings.geminiGcpEnablementSettingsUse
  • cloudaicompanion.settingBindings.loggingSettingsCreate
  • cloudaicompanion.settingBindings.loggingSettingsDelete
  • cloudaicompanion.settingBindings.loggingSettingsGet
  • cloudaicompanion.settingBindings.loggingSettingsList
  • cloudaicompanion.settingBindings.loggingSettingsUpdate
  • cloudaicompanion.settingBindings.loggingSettingsUse
  • cloudaicompanion.settingBindings.releaseChannelSettingsCreate
  • cloudaicompanion.settingBindings.releaseChannelSettingsDelete
  • cloudaicompanion.settingBindings.releaseChannelSettingsGet
  • cloudaicompanion.settingBindings.releaseChannelSettingsList
  • cloudaicompanion.settingBindings.releaseChannelSettingsUpdate
  • cloudaicompanion.settingBindings.releaseChannelSettingsUse

cloudnotifications.activities.list

cloudtrace.insights.*

  • cloudtrace.insights.get
  • cloudtrace.insights.list

cloudtrace.stats.get

cloudtrace.tasks.*

  • cloudtrace.tasks.create
  • cloudtrace.tasks.delete
  • cloudtrace.tasks.get
  • cloudtrace.tasks.list

cloudtrace.traceScopes.*

  • cloudtrace.traceScopes.create
  • cloudtrace.traceScopes.delete
  • cloudtrace.traceScopes.get
  • cloudtrace.traceScopes.list
  • cloudtrace.traceScopes.update

cloudtrace.traces.get

cloudtrace.traces.list

consumerprocurement.entitlements.*

  • consumerprocurement.entitlements.get
  • consumerprocurement.entitlements.list

discoveryengine.accounts.create

discoveryengine.aclConfigs.*

  • discoveryengine.aclConfigs.get
  • discoveryengine.aclConfigs.update

discoveryengine.agentFiles.*

  • discoveryengine.agentFiles.delete
  • discoveryengine.agentFiles.download
  • discoveryengine.agentFiles.import
  • discoveryengine.agentFiles.list
  • discoveryengine.agentFiles.upload

discoveryengine.agentIamProposals.*

  • discoveryengine.agentIamProposals.create
  • discoveryengine.agentIamProposals.delete
  • discoveryengine.agentIamProposals.get
  • discoveryengine.agentIamProposals.list

discoveryengine.agents.create

discoveryengine.agents.delete

discoveryengine.agents.get

discoveryengine.agents.getAgentView

discoveryengine.agents.getIamPolicy

discoveryengine.agents.list

discoveryengine.agents.listAvailableAgentViews

discoveryengine.agents.manage

discoveryengine.agents.setIamPolicy

discoveryengine.agents.update

discoveryengine.alertPolicies.*

  • discoveryengine.alertPolicies.create
  • discoveryengine.alertPolicies.get
  • discoveryengine.alertPolicies.update

discoveryengine.analytics.*

  • discoveryengine.analytics.acquireDashboardSession
  • discoveryengine.analytics.refreshDashboardSessionTokens

discoveryengine.answers.get

discoveryengine.assistAnswers.get

discoveryengine.assistants.*

  • discoveryengine.assistants.assist
  • discoveryengine.assistants.create
  • discoveryengine.assistants.delete
  • discoveryengine.assistants.get
  • discoveryengine.assistants.list
  • discoveryengine.assistants.update

discoveryengine.audioOverviews.*

  • discoveryengine.audioOverviews.create
  • discoveryengine.audioOverviews.delete
  • discoveryengine.audioOverviews.get
  • discoveryengine.audioOverviews.getIceConfig
  • discoveryengine.audioOverviews.sendSdpOffer

discoveryengine.authorizations.*

  • discoveryengine.authorizations.create
  • discoveryengine.authorizations.delete
  • discoveryengine.authorizations.get
  • discoveryengine.authorizations.list
  • discoveryengine.authorizations.storeUserAuthorization
  • discoveryengine.authorizations.update

discoveryengine.billingAccountLicenseConfigs.*

  • discoveryengine.billingAccountLicenseConfigs.distribute
  • discoveryengine.billingAccountLicenseConfigs.get
  • discoveryengine.billingAccountLicenseConfigs.list
  • discoveryengine.billingAccountLicenseConfigs.retract

discoveryengine.branches.*

  • discoveryengine.branches.get
  • discoveryengine.branches.list

discoveryengine.cannedQueries.*

  • discoveryengine.cannedQueries.create
  • discoveryengine.cannedQueries.delete
  • discoveryengine.cannedQueries.get
  • discoveryengine.cannedQueries.list
  • discoveryengine.cannedQueries.listActiveCannedQueryUserViews
  • discoveryengine.cannedQueries.update

discoveryengine.cmekConfigs.*

  • discoveryengine.cmekConfigs.delete
  • discoveryengine.cmekConfigs.get
  • discoveryengine.cmekConfigs.list
  • discoveryengine.cmekConfigs.update

discoveryengine.collections.*

  • discoveryengine.collections.delete
  • discoveryengine.collections.get
  • discoveryengine.collections.getIamPolicy
  • discoveryengine.collections.list
  • discoveryengine.collections.setIamPolicy

discoveryengine.completionConfigs.*

  • discoveryengine.completionConfigs.completeQuery
  • discoveryengine.completionConfigs.get
  • discoveryengine.completionConfigs.removeSuggestion
  • discoveryengine.completionConfigs.update

discoveryengine.completionSuggestions.*

  • discoveryengine.completionSuggestions.import
  • discoveryengine.completionSuggestions.purge

discoveryengine.connectorRuns.*

  • discoveryengine.connectorRuns.cancel
  • discoveryengine.connectorRuns.list

discoveryengine.controls.*

  • discoveryengine.controls.create
  • discoveryengine.controls.delete
  • discoveryengine.controls.get
  • discoveryengine.controls.list
  • discoveryengine.controls.update

discoveryengine.conversations.*

  • discoveryengine.conversations.converse
  • discoveryengine.conversations.create
  • discoveryengine.conversations.delete
  • discoveryengine.conversations.get
  • discoveryengine.conversations.list
  • discoveryengine.conversations.update

discoveryengine.dataConnectors.*

  • discoveryengine.dataConnectors.acquireAccessToken
  • discoveryengine.dataConnectors.acquireAndStoreRefreshToken
  • discoveryengine.dataConnectors.buildActionInvocation
  • discoveryengine.dataConnectors.checkRefreshToken
  • discoveryengine.dataConnectors.executeAction
  • discoveryengine.dataConnectors.get
  • discoveryengine.dataConnectors.queryAvailableActions
  • discoveryengine.dataConnectors.startConnectorRun
  • discoveryengine.dataConnectors.update

discoveryengine.dataStores.*

  • discoveryengine.dataStores.completeQuery
  • discoveryengine.dataStores.create
  • discoveryengine.dataStores.delete
  • discoveryengine.dataStores.enrollSolutions
  • discoveryengine.dataStores.get
  • discoveryengine.dataStores.getIamPolicy
  • discoveryengine.dataStores.list
  • discoveryengine.dataStores.listCustomModels
  • discoveryengine.dataStores.setIamPolicy
  • discoveryengine.dataStores.trainCustomModel
  • discoveryengine.dataStores.update

discoveryengine.devToolsConfigs.*

  • discoveryengine.devToolsConfigs.get
  • discoveryengine.devToolsConfigs.update

discoveryengine.documentProcessingConfigs.*

  • discoveryengine.documentProcessingConfigs.get
  • discoveryengine.documentProcessingConfigs.update

discoveryengine.documents.*

  • discoveryengine.documents.batchGetDocumentsMetadata
  • discoveryengine.documents.create
  • discoveryengine.documents.delete
  • discoveryengine.documents.get
  • discoveryengine.documents.import
  • discoveryengine.documents.list
  • discoveryengine.documents.purge
  • discoveryengine.documents.update

discoveryengine.engines.*

  • discoveryengine.engines.create
  • discoveryengine.engines.createEngineUserData
  • discoveryengine.engines.delete
  • discoveryengine.engines.generateMemories
  • discoveryengine.engines.generatePersonalContext
  • discoveryengine.engines.get
  • discoveryengine.engines.getEngineUserData
  • discoveryengine.engines.getIamPolicy
  • discoveryengine.engines.getPersonalContext
  • discoveryengine.engines.list
  • discoveryengine.engines.pause
  • discoveryengine.engines.resume
  • discoveryengine.engines.setIamPolicy
  • discoveryengine.engines.tune
  • discoveryengine.engines.update
  • discoveryengine.engines.updateEngineUserData

discoveryengine.evaluations.*

  • discoveryengine.evaluations.create
  • discoveryengine.evaluations.get
  • discoveryengine.evaluations.list

discoveryengine.groundingConfigs.check

discoveryengine.homepageDataConfigs.fetchDocuments

discoveryengine.ideaForgeIdeas.*

  • discoveryengine.ideaForgeIdeas.create
  • discoveryengine.ideaForgeIdeas.get

discoveryengine.ideaForgeInstances.*

  • discoveryengine.ideaForgeInstances.get
  • discoveryengine.ideaForgeInstances.start
  • discoveryengine.ideaForgeInstances.stop

discoveryengine.identityMappingStores.*

  • discoveryengine.identityMappingStores.create
  • discoveryengine.identityMappingStores.delete
  • discoveryengine.identityMappingStores.get
  • discoveryengine.identityMappingStores.importIdentityMappings
  • discoveryengine.identityMappingStores.list
  • discoveryengine.identityMappingStores.listIdentityMappings
  • discoveryengine.identityMappingStores.purgeIdentityMappings

discoveryengine.licenseConfigs.*

  • discoveryengine.licenseConfigs.create
  • discoveryengine.licenseConfigs.get
  • discoveryengine.licenseConfigs.list
  • discoveryengine.licenseConfigs.update

discoveryengine.locations.*

  • discoveryengine.locations.completeExternalIdentities
  • discoveryengine.locations.estimateDataSize
  • discoveryengine.locations.exchangeAuthCredentials
  • discoveryengine.locations.fetchAgentCards
  • discoveryengine.locations.getConnectorSource
  • discoveryengine.locations.listConnectorSources
  • discoveryengine.locations.setUpDataConnector

discoveryengine.memories.*

  • discoveryengine.memories.delete
  • discoveryengine.memories.list
  • discoveryengine.memories.retrieve
  • discoveryengine.memories.update

discoveryengine.models.*

  • discoveryengine.models.create
  • discoveryengine.models.delete
  • discoveryengine.models.get
  • discoveryengine.models.list
  • discoveryengine.models.pause
  • discoveryengine.models.resume
  • discoveryengine.models.tune
  • discoveryengine.models.update

discoveryengine.notebooks.*

  • discoveryengine.notebooks.create
  • discoveryengine.notebooks.generateGuide
  • discoveryengine.notebooks.get
  • discoveryengine.notebooks.getAnalytics
  • discoveryengine.notebooks.getIamPolicy
  • discoveryengine.notebooks.interactSources
  • discoveryengine.notebooks.list
  • discoveryengine.notebooks.removeSelf
  • discoveryengine.notebooks.setIamPolicy
  • discoveryengine.notebooks.update

discoveryengine.notes.*

  • discoveryengine.notes.create
  • discoveryengine.notes.delete
  • discoveryengine.notes.get
  • discoveryengine.notes.update

discoveryengine.notificationMessages.*

  • discoveryengine.notificationMessages.ackAll
  • discoveryengine.notificationMessages.list
  • discoveryengine.notificationMessages.update

discoveryengine.operations.*

  • discoveryengine.operations.get
  • discoveryengine.operations.list

discoveryengine.projectOverageConfigs.get

discoveryengine.projects.*

  • discoveryengine.projects.get
  • discoveryengine.projects.provision
  • discoveryengine.projects.reportConsentChange
  • discoveryengine.projects.update

discoveryengine.rankingConfigs.rank

discoveryengine.sampleQueries.*

  • discoveryengine.sampleQueries.create
  • discoveryengine.sampleQueries.delete
  • discoveryengine.sampleQueries.get
  • discoveryengine.sampleQueries.import
  • discoveryengine.sampleQueries.list
  • discoveryengine.sampleQueries.update

discoveryengine.sampleQuerySets.*

  • discoveryengine.sampleQuerySets.create
  • discoveryengine.sampleQuerySets.delete
  • discoveryengine.sampleQuerySets.get
  • discoveryengine.sampleQuerySets.list
  • discoveryengine.sampleQuerySets.update

discoveryengine.schemas.*

  • discoveryengine.schemas.create
  • discoveryengine.schemas.delete
  • discoveryengine.schemas.get
  • discoveryengine.schemas.list
  • discoveryengine.schemas.preview
  • discoveryengine.schemas.update
  • discoveryengine.schemas.validate

discoveryengine.servingConfigs.*

  • discoveryengine.servingConfigs.answer
  • discoveryengine.servingConfigs.create
  • discoveryengine.servingConfigs.delete
  • discoveryengine.servingConfigs.get
  • discoveryengine.servingConfigs.list
  • discoveryengine.servingConfigs.recommend
  • discoveryengine.servingConfigs.search
  • discoveryengine.servingConfigs.update

discoveryengine.sessions.*

  • discoveryengine.sessions.addContextFile
  • discoveryengine.sessions.create
  • discoveryengine.sessions.delete
  • discoveryengine.sessions.downloadFile
  • discoveryengine.sessions.generateSummary
  • discoveryengine.sessions.get
  • discoveryengine.sessions.list
  • discoveryengine.sessions.listSessionFileMetadata
  • discoveryengine.sessions.recommendQuestions
  • discoveryengine.sessions.removeContextFile
  • discoveryengine.sessions.search
  • discoveryengine.sessions.selectContextFiles
  • discoveryengine.sessions.update
  • discoveryengine.sessions.uploadFile

discoveryengine.sharedContents.*

  • discoveryengine.sharedContents.create
  • discoveryengine.sharedContents.delete
  • discoveryengine.sharedContents.get
  • discoveryengine.sharedContents.list

discoveryengine.siteSearchEngines.*

  • discoveryengine.siteSearchEngines.batchVerifyTargetSites
  • discoveryengine.siteSearchEngines.disableAdvancedSiteSearch
  • discoveryengine.siteSearchEngines.enableAdvancedSiteSearch
  • discoveryengine.siteSearchEngines.fetchDomainVerificationStatus
  • discoveryengine.siteSearchEngines.get
  • discoveryengine.siteSearchEngines.recrawlUris

discoveryengine.sitemaps.*

  • discoveryengine.sitemaps.create
  • discoveryengine.sitemaps.delete
  • discoveryengine.sitemaps.fetch

discoveryengine.sources.*

  • discoveryengine.sources.checkFreshness
  • discoveryengine.sources.create
  • discoveryengine.sources.delete
  • discoveryengine.sources.generateDocumentGuide
  • discoveryengine.sources.get
  • discoveryengine.sources.refresh
  • discoveryengine.sources.update

discoveryengine.suggestionDenyListEntries.*

  • discoveryengine.suggestionDenyListEntries.import
  • discoveryengine.suggestionDenyListEntries.purge

discoveryengine.targetSites.*

  • discoveryengine.targetSites.batchCreate
  • discoveryengine.targetSites.create
  • discoveryengine.targetSites.delete
  • discoveryengine.targetSites.get
  • discoveryengine.targetSites.list
  • discoveryengine.targetSites.update

discoveryengine.userEvents.*

  • discoveryengine.userEvents.create
  • discoveryengine.userEvents.fetchStats
  • discoveryengine.userEvents.import
  • discoveryengine.userEvents.purge

discoveryengine.userStores.*

  • discoveryengine.userStores.batchUpdateUserLicenses
  • discoveryengine.userStores.get
  • discoveryengine.userStores.listUserLicenses
  • discoveryengine.userStores.update

discoveryengine.users.*

  • discoveryengine.users.get
  • discoveryengine.users.update

discoveryengine.widgetConfigs.*

  • discoveryengine.widgetConfigs.get
  • discoveryengine.widgetConfigs.update

logging.buckets.get

logging.buckets.list

logging.exclusions.get

logging.exclusions.list

logging.links.get

logging.links.list

logging.locations.*

  • logging.locations.get
  • logging.locations.list

logging.logEntries.list

logging.logMetrics.get

logging.logMetrics.list

logging.logScopes.get

logging.logScopes.list

logging.logServiceIndexes.list

logging.logServices.list

logging.logs.list

logging.operations.get

logging.operations.list

logging.queries.getShared

logging.queries.listShared

logging.queries.usePrivate

logging.sinks.get

logging.sinks.list

logging.usage.get

logging.views.get

logging.views.list

monitoring.alertPolicies.get

monitoring.alertPolicies.list

monitoring.alertPolicies.listEffectiveTags

monitoring.alertPolicies.listTagBindings

monitoring.alerts.*

  • monitoring.alerts.get
  • monitoring.alerts.list

monitoring.dashboards.get

monitoring.dashboards.list

monitoring.dashboards.listEffectiveTags

monitoring.dashboards.listTagBindings

monitoring.groups.get

monitoring.groups.list

monitoring.metricDescriptors.get

monitoring.metricDescriptors.list

monitoring.monitoredResourceDescriptors.*

  • monitoring.monitoredResourceDescriptors.get
  • monitoring.monitoredResourceDescriptors.list

monitoring.notificationChannelDescriptors.*

  • monitoring.notificationChannelDescriptors.get
  • monitoring.notificationChannelDescriptors.list

monitoring.notificationChannels.get

monitoring.notificationChannels.list

monitoring.services.get

monitoring.services.list

monitoring.slos.get

monitoring.slos.list

monitoring.snoozes.get

monitoring.snoozes.list

monitoring.timeSeries.list

monitoring.uptimeCheckConfigs.get

monitoring.uptimeCheckConfigs.list

observability.scopes.get

observability.traceScopes.*

  • observability.traceScopes.create
  • observability.traceScopes.delete
  • observability.traceScopes.get
  • observability.traceScopes.list
  • observability.traceScopes.update

opsconfigmonitoring.resourceMetadata.list

resourcemanager.projects.get

resourcemanager.projects.list

stackdriver.projects.get

stackdriver.resourceMetadata.list

(roles/discoveryengine.editor)

מעניק הרשאת קריאה וכתיבה לכל משאבי מנוע הגילוי.

discoveryengine.aclConfigs.get

discoveryengine.agentFiles.*

  • discoveryengine.agentFiles.delete
  • discoveryengine.agentFiles.download
  • discoveryengine.agentFiles.import
  • discoveryengine.agentFiles.list
  • discoveryengine.agentFiles.upload

discoveryengine.agents.create

discoveryengine.agents.delete

discoveryengine.agents.get

discoveryengine.agents.getAgentView

discoveryengine.agents.getIamPolicy

discoveryengine.agents.list

discoveryengine.agents.listAvailableAgentViews

discoveryengine.agents.manage

discoveryengine.agents.update

discoveryengine.alertPolicies.get

discoveryengine.analytics.*

  • discoveryengine.analytics.acquireDashboardSession
  • discoveryengine.analytics.refreshDashboardSessionTokens

discoveryengine.answers.get

discoveryengine.assistAnswers.get

discoveryengine.assistants.assist

discoveryengine.assistants.get

discoveryengine.assistants.list

discoveryengine.authorizations.storeUserAuthorization

discoveryengine.branches.*

  • discoveryengine.branches.get
  • discoveryengine.branches.list

discoveryengine.cannedQueries.get

discoveryengine.cannedQueries.list

discoveryengine.cannedQueries.listActiveCannedQueryUserViews

discoveryengine.cmekConfigs.get

discoveryengine.cmekConfigs.list

discoveryengine.collections.get

discoveryengine.collections.list

discoveryengine.completionConfigs.completeQuery

discoveryengine.completionConfigs.get

discoveryengine.completionConfigs.removeSuggestion

discoveryengine.connectorRuns.list

discoveryengine.controls.get

discoveryengine.controls.list

discoveryengine.conversations.*

  • discoveryengine.conversations.converse
  • discoveryengine.conversations.create
  • discoveryengine.conversations.delete
  • discoveryengine.conversations.get
  • discoveryengine.conversations.list
  • discoveryengine.conversations.update

discoveryengine.dataConnectors.acquireAccessToken

discoveryengine.dataConnectors.acquireAndStoreRefreshToken

discoveryengine.dataConnectors.buildActionInvocation

discoveryengine.dataConnectors.checkRefreshToken

discoveryengine.dataConnectors.executeAction

discoveryengine.dataConnectors.get

discoveryengine.dataConnectors.queryAvailableActions

discoveryengine.dataStores.completeQuery

discoveryengine.dataStores.get

discoveryengine.dataStores.list

discoveryengine.dataStores.listCustomModels

discoveryengine.dataStores.trainCustomModel

discoveryengine.devToolsConfigs.get

discoveryengine.documentProcessingConfigs.get

discoveryengine.documents.batchGetDocumentsMetadata

discoveryengine.documents.create

discoveryengine.documents.delete

discoveryengine.documents.get

discoveryengine.documents.import

discoveryengine.documents.list

discoveryengine.documents.update

discoveryengine.engines.createEngineUserData

discoveryengine.engines.generateMemories

discoveryengine.engines.generatePersonalContext

discoveryengine.engines.get

discoveryengine.engines.getEngineUserData

discoveryengine.engines.getPersonalContext

discoveryengine.engines.list

discoveryengine.engines.pause

discoveryengine.engines.resume

discoveryengine.engines.tune

discoveryengine.engines.updateEngineUserData

discoveryengine.evaluations.get

discoveryengine.evaluations.list

discoveryengine.groundingConfigs.check

discoveryengine.homepageDataConfigs.fetchDocuments

discoveryengine.ideaForgeIdeas.*

  • discoveryengine.ideaForgeIdeas.create
  • discoveryengine.ideaForgeIdeas.get

discoveryengine.ideaForgeInstances.*

  • discoveryengine.ideaForgeInstances.get
  • discoveryengine.ideaForgeInstances.start
  • discoveryengine.ideaForgeInstances.stop

discoveryengine.identityMappingStores.*

  • discoveryengine.identityMappingStores.create
  • discoveryengine.identityMappingStores.delete
  • discoveryengine.identityMappingStores.get
  • discoveryengine.identityMappingStores.importIdentityMappings
  • discoveryengine.identityMappingStores.list
  • discoveryengine.identityMappingStores.listIdentityMappings
  • discoveryengine.identityMappingStores.purgeIdentityMappings

discoveryengine.licenseConfigs.get

discoveryengine.licenseConfigs.list

discoveryengine.locations.completeExternalIdentities

discoveryengine.locations.fetchAgentCards

discoveryengine.memories.*

  • discoveryengine.memories.delete
  • discoveryengine.memories.list
  • discoveryengine.memories.retrieve
  • discoveryengine.memories.update

discoveryengine.models.*

  • discoveryengine.models.create
  • discoveryengine.models.delete
  • discoveryengine.models.get
  • discoveryengine.models.list
  • discoveryengine.models.pause
  • discoveryengine.models.resume
  • discoveryengine.models.tune
  • discoveryengine.models.update

discoveryengine.notificationMessages.*

  • discoveryengine.notificationMessages.ackAll
  • discoveryengine.notificationMessages.list
  • discoveryengine.notificationMessages.update

discoveryengine.operations.*

  • discoveryengine.operations.get
  • discoveryengine.operations.list

discoveryengine.projectOverageConfigs.get

discoveryengine.projects.get

discoveryengine.rankingConfigs.rank

discoveryengine.sampleQueries.*

  • discoveryengine.sampleQueries.create
  • discoveryengine.sampleQueries.delete
  • discoveryengine.sampleQueries.get
  • discoveryengine.sampleQueries.import
  • discoveryengine.sampleQueries.list
  • discoveryengine.sampleQueries.update

discoveryengine.sampleQuerySets.*

  • discoveryengine.sampleQuerySets.create
  • discoveryengine.sampleQuerySets.delete
  • discoveryengine.sampleQuerySets.get
  • discoveryengine.sampleQuerySets.list
  • discoveryengine.sampleQuerySets.update

discoveryengine.schemas.get

discoveryengine.schemas.list

discoveryengine.schemas.preview

discoveryengine.schemas.validate

discoveryengine.servingConfigs.answer

discoveryengine.servingConfigs.get

discoveryengine.servingConfigs.list

discoveryengine.servingConfigs.recommend

discoveryengine.servingConfigs.search

discoveryengine.sessions.*

  • discoveryengine.sessions.addContextFile
  • discoveryengine.sessions.create
  • discoveryengine.sessions.delete
  • discoveryengine.sessions.downloadFile
  • discoveryengine.sessions.generateSummary
  • discoveryengine.sessions.get
  • discoveryengine.sessions.list
  • discoveryengine.sessions.listSessionFileMetadata
  • discoveryengine.sessions.recommendQuestions
  • discoveryengine.sessions.removeContextFile
  • discoveryengine.sessions.search
  • discoveryengine.sessions.selectContextFiles
  • discoveryengine.sessions.update
  • discoveryengine.sessions.uploadFile

discoveryengine.sharedContents.*

  • discoveryengine.sharedContents.create
  • discoveryengine.sharedContents.delete
  • discoveryengine.sharedContents.get
  • discoveryengine.sharedContents.list

discoveryengine.siteSearchEngines.get

discoveryengine.targetSites.get

discoveryengine.targetSites.list

discoveryengine.userEvents.create

discoveryengine.userEvents.fetchStats

discoveryengine.userEvents.import

discoveryengine.userStores.get

discoveryengine.widgetConfigs.*

  • discoveryengine.widgetConfigs.get
  • discoveryengine.widgetConfigs.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/discoveryengine.agentspaceUser)

ההרשאה מאפשרת גישה למשאבי Gemini Enterprise ברמת המשתמש.

businessaicode.*

  • businessaicode.locations.fetchQuotaStatus
  • businessaicode.locations.generateContent
  • businessaicode.locations.queryConfiguration
  • businessaicode.locations.selfAssignLicense
  • businessaicode.locations.sendTelemetry

cloudaicompanion.companions.*

  • cloudaicompanion.companions.generateChat
  • cloudaicompanion.companions.generateCode

cloudaicompanion.entitlements.get

cloudaicompanion.instances.*

  • cloudaicompanion.instances.completeCode
  • cloudaicompanion.instances.completeTask
  • cloudaicompanion.instances.exportMetrics
  • cloudaicompanion.instances.generateCode
  • cloudaicompanion.instances.generateText
  • cloudaicompanion.instances.queryEffectiveSetting
  • cloudaicompanion.instances.queryEffectiveSettingBindings

cloudaicompanion.licenses.selfAssign

cloudaicompanion.operations.get

cloudaicompanion.topics.create

discoveryengine.accounts.create

discoveryengine.agentFiles.*

  • discoveryengine.agentFiles.delete
  • discoveryengine.agentFiles.download
  • discoveryengine.agentFiles.import
  • discoveryengine.agentFiles.list
  • discoveryengine.agentFiles.upload

discoveryengine.agentIamProposals.*

  • discoveryengine.agentIamProposals.create
  • discoveryengine.agentIamProposals.delete
  • discoveryengine.agentIamProposals.get
  • discoveryengine.agentIamProposals.list

discoveryengine.agents.create

discoveryengine.agents.delete

discoveryengine.agents.get

discoveryengine.agents.getAgentView

discoveryengine.agents.list

discoveryengine.agents.listAvailableAgentViews

discoveryengine.agents.requestReview

discoveryengine.agents.update

discoveryengine.answers.get

discoveryengine.assistAnswers.get

discoveryengine.assistants.assist

discoveryengine.authorizations.storeUserAuthorization

discoveryengine.cannedQueries.listActiveCannedQueryUserViews

discoveryengine.collections.get

discoveryengine.completionConfigs.completeQuery

discoveryengine.completionConfigs.removeSuggestion

discoveryengine.dataConnectors.acquireAccessToken

discoveryengine.dataConnectors.acquireAndStoreRefreshToken

discoveryengine.dataConnectors.buildActionInvocation

discoveryengine.dataConnectors.checkRefreshToken

discoveryengine.dataConnectors.executeAction

discoveryengine.dataConnectors.queryAvailableActions

discoveryengine.dataStores.get

discoveryengine.devToolsConfigs.get

discoveryengine.engines.createEngineUserData

discoveryengine.engines.generateMemories

discoveryengine.engines.generatePersonalContext

discoveryengine.engines.get

discoveryengine.engines.getEngineUserData

discoveryengine.engines.getPersonalContext

discoveryengine.engines.updateEngineUserData

discoveryengine.homepageDataConfigs.fetchDocuments

discoveryengine.ideaForgeIdeas.*

  • discoveryengine.ideaForgeIdeas.create
  • discoveryengine.ideaForgeIdeas.get

discoveryengine.ideaForgeInstances.*

  • discoveryengine.ideaForgeInstances.get
  • discoveryengine.ideaForgeInstances.start
  • discoveryengine.ideaForgeInstances.stop

discoveryengine.locations.completeExternalIdentities

discoveryengine.locations.fetchAgentCards

discoveryengine.memories.*

  • discoveryengine.memories.delete
  • discoveryengine.memories.list
  • discoveryengine.memories.retrieve
  • discoveryengine.memories.update

discoveryengine.notebooks.create

discoveryengine.notebooks.list

discoveryengine.notificationMessages.*

  • discoveryengine.notificationMessages.ackAll
  • discoveryengine.notificationMessages.list
  • discoveryengine.notificationMessages.update

discoveryengine.servingConfigs.answer

discoveryengine.servingConfigs.recommend

discoveryengine.servingConfigs.search

discoveryengine.sessions.*

  • discoveryengine.sessions.addContextFile
  • discoveryengine.sessions.create
  • discoveryengine.sessions.delete
  • discoveryengine.sessions.downloadFile
  • discoveryengine.sessions.generateSummary
  • discoveryengine.sessions.get
  • discoveryengine.sessions.list
  • discoveryengine.sessions.listSessionFileMetadata
  • discoveryengine.sessions.recommendQuestions
  • discoveryengine.sessions.removeContextFile
  • discoveryengine.sessions.search
  • discoveryengine.sessions.selectContextFiles
  • discoveryengine.sessions.update
  • discoveryengine.sessions.uploadFile

discoveryengine.sharedContents.*

  • discoveryengine.sharedContents.create
  • discoveryengine.sharedContents.delete
  • discoveryengine.sharedContents.get
  • discoveryengine.sharedContents.list

discoveryengine.userEvents.create

discoveryengine.users.*

  • discoveryengine.users.get
  • discoveryengine.users.update

discoveryengine.widgetConfigs.get

geminicloudassist.agents.invoke

resourcemanager.projects.get

resourcemanager.projects.list

(roles/discoveryengine.agentspaceRestrictedUser)

ההרשאה מעניקה גישה מוגבלת למשאבי Gemini Enterprise ברמת המשתמש, כדי לאפשר שליטה מדויקת בכמה מופעים של Gemini Enterprise באותו פרויקט. כדי להשתמש ב-Gemini Enterprise, צריך להעניק לחשבונות משתמש עם התפקיד הזה תפקיד ברמת המשתמש ללא הגבלות (למשל, /agentspaceUser) במדיניות של מנוע.

discoveryengine.accounts.create

discoveryengine.authorizations.storeUserAuthorization

discoveryengine.collections.get

discoveryengine.dataConnectors.acquireAccessToken

discoveryengine.dataConnectors.acquireAndStoreRefreshToken

discoveryengine.dataConnectors.buildActionInvocation

discoveryengine.dataConnectors.checkRefreshToken

discoveryengine.dataConnectors.executeAction

discoveryengine.dataConnectors.queryAvailableActions

discoveryengine.dataStores.get

discoveryengine.locations.completeExternalIdentities

discoveryengine.locations.fetchAgentCards

discoveryengine.notebooks.create

discoveryengine.notebooks.list

discoveryengine.userEvents.create

discoveryengine.users.*

  • discoveryengine.users.get
  • discoveryengine.users.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/discoveryengine.viewer)

התפקיד הזה מעניק הרשאת קריאה לכל המשאבים של מנוע הגילוי.

discoveryengine.aclConfigs.get

discoveryengine.agentFiles.list

discoveryengine.agents.get

discoveryengine.agents.getAgentView

discoveryengine.agents.getIamPolicy

discoveryengine.agents.list

discoveryengine.agents.listAvailableAgentViews

discoveryengine.alertPolicies.get

discoveryengine.analytics.*

  • discoveryengine.analytics.acquireDashboardSession
  • discoveryengine.analytics.refreshDashboardSessionTokens

discoveryengine.answers.get

discoveryengine.assistAnswers.get

discoveryengine.assistants.get

discoveryengine.assistants.list

discoveryengine.branches.*

  • discoveryengine.branches.get
  • discoveryengine.branches.list

discoveryengine.cannedQueries.get

discoveryengine.cannedQueries.list

discoveryengine.cannedQueries.listActiveCannedQueryUserViews

discoveryengine.cmekConfigs.get

discoveryengine.cmekConfigs.list

discoveryengine.collections.get

discoveryengine.collections.list

discoveryengine.completionConfigs.completeQuery

discoveryengine.completionConfigs.get

discoveryengine.connectorRuns.list

discoveryengine.controls.get

discoveryengine.controls.list

discoveryengine.conversations.converse

discoveryengine.conversations.get

discoveryengine.conversations.list

discoveryengine.dataConnectors.buildActionInvocation

discoveryengine.dataConnectors.checkRefreshToken

discoveryengine.dataConnectors.get

discoveryengine.dataConnectors.queryAvailableActions

discoveryengine.dataStores.completeQuery

discoveryengine.dataStores.get

discoveryengine.dataStores.list

discoveryengine.dataStores.listCustomModels

discoveryengine.devToolsConfigs.get

discoveryengine.documentProcessingConfigs.get

discoveryengine.documents.batchGetDocumentsMetadata

discoveryengine.documents.get

discoveryengine.documents.list

discoveryengine.engines.get

discoveryengine.engines.getPersonalContext

discoveryengine.engines.list

discoveryengine.evaluations.get

discoveryengine.evaluations.list

discoveryengine.groundingConfigs.check

discoveryengine.homepageDataConfigs.fetchDocuments

discoveryengine.ideaForgeIdeas.get

discoveryengine.ideaForgeInstances.get

discoveryengine.identityMappingStores.get

discoveryengine.identityMappingStores.list

discoveryengine.identityMappingStores.listIdentityMappings

discoveryengine.locations.completeExternalIdentities

discoveryengine.locations.fetchAgentCards

discoveryengine.memories.list

discoveryengine.memories.retrieve

discoveryengine.models.get

discoveryengine.models.list

discoveryengine.notificationMessages.list

discoveryengine.operations.*

  • discoveryengine.operations.get
  • discoveryengine.operations.list

discoveryengine.projectOverageConfigs.get

discoveryengine.projects.get

discoveryengine.rankingConfigs.rank

discoveryengine.sampleQueries.get

discoveryengine.sampleQueries.list

discoveryengine.sampleQuerySets.get

discoveryengine.sampleQuerySets.list

discoveryengine.schemas.get

discoveryengine.schemas.list

discoveryengine.schemas.preview

discoveryengine.schemas.validate

discoveryengine.servingConfigs.answer

discoveryengine.servingConfigs.get

discoveryengine.servingConfigs.list

discoveryengine.servingConfigs.recommend

discoveryengine.servingConfigs.search

discoveryengine.sessions.downloadFile

discoveryengine.sessions.generateSummary

discoveryengine.sessions.get

discoveryengine.sessions.list

discoveryengine.sessions.listSessionFileMetadata

discoveryengine.sessions.recommendQuestions

discoveryengine.sharedContents.get

discoveryengine.sharedContents.list

discoveryengine.siteSearchEngines.get

discoveryengine.targetSites.get

discoveryengine.targetSites.list

discoveryengine.userEvents.fetchStats

discoveryengine.userStores.get

discoveryengine.widgetConfigs.get

resourcemanager.projects.get

resourcemanager.projects.list

ניהול IAM ב-Gemini Enterprise

אפשר לקבל ולהגדיר מדיניות הרשאה של IAM ותפקידי IAM באמצעות Google Cloud המסוף. מידע נוסף מופיע במאמר ניהול הגישה לפרויקטים, לתיקיות ולארגונים.

מתן הרשאות לאדמינים

בתור בעלי הפרויקט, אתם יכולים להעניק את התפקידים Gemini Enterprise Admin,‏ Service Usage Consumer ו-Logs Viewer למשתמשים שרוצים להיות אדמינים.

כדי להוסיף את התפקידים:

  1. נכנסים לדף IAM במסוף Google Cloud .

    כניסה לדף IAM
  2. בוחרים את הפרויקט.
  3. לוחצים על Grant access.

  4. בשדה New principals, מזינים את מזהה המשתמש. בדרך כלל מזהה המשתמש הוא כתובת האימייל של חשבון Google או של קבוצת משתמשים.

  5. מוסיפים את התפקידים:
    1. לוחצים על הוספת תפקיד נוסף.
    2. ברשימה Select a role בוחרים באפשרות Gemini Enterprise Admin.
    3. חוזרים על שלבים א' ו-ב' כדי להוסיף את התפקידים Service usage consumer ו-מציג היומנים.
  6. לוחצים על Save.

הענקת הרשאות למשתמשים

בקטע הזה מוסבר איך מקצים למשתמשים את התפקידים ברמת הפרויקט שנדרשים להם כדי לגשת לאפליקציות Gemini Enterprise. בהתאם למודל הגישה שלכם, בוחרים אחת מהתפקידים הבאים:

  • גישה לכל האפליקציות בפרויקט: מקצים את התפקיד Gemini Enterprise User ‏(roles/discoveryengine.agentspaceUser) ברמת הפרויקט.
  • גישה לאפליקציות ספציפיות בלבד: מקצים את התפקיד Gemini Enterprise Restricted User (roles/discoveryengine.agentspaceRestrictedUser) ברמת הפרויקט, ואז מקצים את התפקיד Gemini Enterprise User (roles/discoveryengine.agentspaceUser) באפליקציות הספציפיות. התפקיד 'משתמש מוגבל' לא מעניק גישה לאף אפליקציה כשלעצמו, כך שהמשתמשים יכולים לפתוח רק את האפליקציות שבהן הקציתם להם את התפקיד 'משתמש Gemini Enterprise'. מידע נוסף מופיע במאמר הגדרת אמצעי בקרת גישה לאפליקציות.

כדי להעניק את התפקיד ברמת הפרויקט במסוף Google Cloud , פועלים לפי השלבים הבאים:

  1. נכנסים לדף IAM במסוף Google Cloud .

    כניסה לדף IAM
  2. בוחרים את הפרויקט.
  3. לוחצים על Grant access.

  4. בשדה New principals, מזינים את מזהה המשתמש. בדרך כלל זה המזהה של משתמש במאגר זהויות של כוח עבודה, או כתובת האימייל של חשבון Google או של קבוצת משתמשים. פרטים נוספים מופיעים במאמר בנושא מזהים של חשבונות משתמשים במדיניות הרשאות.

  5. מוסיפים את התפקיד ברמת הפרויקט:

    1. לוחצים על הוספת תפקיד נוסף.

    2. ברשימה Select a role, בוחרים באחד מהתפקידים הבאים:

  6. לוחצים על Save.

  7. אם הקציתם את התפקיד Gemini Enterprise Restricted User, צריך להקצות את התפקיד Gemini Enterprise User (roles/discoveryengine.agentspaceUser) לכל אפליקציה שהמשתמש צריך גישה אליה. הוראות מפורטות מופיעות במאמר הגדרת אמצעי בקרת גישה לאפליקציות.

כדי לאפשר למשתמשים לנהל ולשתף אפליקציות, צריך להקצות להם את התפקיד צפייה ב-Discovery Engine (roles/discoveryengine.viewer).

המאמרים הבאים