Google Cloud's Policy MCP Server Lets AI Agents Rewrite Cloud Security Rules

What happened

Why it matters

• ·An agent with write access to Organization Policy can create or modify the rules that govern every Google Cloud workload in a project or folder. If an agent is compromised or behaves unexpectedly, the blast radius extends to the entire cloud configuration, not just a single task. Compliance teams should confirm that agents connecting to this server are restricted to read-only access by default, with write permissions requiring separate approval.
• ·The natural-language policy authoring feature introduces a new audit documentation requirement. If a policy constraint is created from a Gemini prompt, the original prompt, the generated constraint, and any test results must be retained and reviewable. Auditors must confirm that the enforced rule matches what the administrator intended. Generic change logs may not capture this chain of events.
• ·Connecting autonomous agents to cloud policy infrastructure raises direct obligations under frameworks requiring human oversight of consequential configuration changes. These include the EU AI Act (Regulation (EU) 2024/1689) and financial-sector model risk guidance. Organizations in regulated industries must assess whether policy creation by an agent constitutes a change that requires human approval before it takes effect.

Governance controls affected

What to do now

• ☐Identify every AI agent or automated pipeline in your Google Cloud environment that has been, or could be, connected to the Organization Policy MCP server, and confirm whether each one has read-only or write access.
• ☐Set a policy requiring that any agent-initiated creation or modification of an Organization Policy constraint triggers a human review step before the constraint is enforced, and verify this gate is in place before connecting any agent to the server.
• ☐Ask your engineering team to confirm that every call to the `CreatePolicy` and `CreateCustomConstraint` tools is captured in an audit log, including the agent identity, the prompt or instruction that triggered the call, and the resulting constraint text.
• ☐Review the dry-run and test-configuration features with your security team to confirm they are used for every new agent-authored constraint before enforcement, and document the test results as part of your change record.
• ☐If your organization operates under financial-sector model risk management guidance or the EU AI Act, formally assess whether agent-driven policy creation constitutes a material configuration change requiring pre-approval and documentation under those frameworks.

What to watch next

The Five Eyes Guidance on the Careful Adoption of Agentic AI Services calls for agents to operate under least-privilege access. All consequential actions must be logged and attributable. Compliance teams should monitor whether Google Cloud or other cloud providers extend similar MCP write-access capabilities to other infrastructure layers. This includes identity and access management rules or network policies. Regulatory signals from the EU AI Act (Regulation (EU) 2024/1689) enforcement track will shape requirements for agent-initiated policy changes. Guidance on what constitutes a high-risk automated action in cloud infrastructure will determine whether formal conformity assessment is required. The growing body of MCP vulnerability research also suggests that authentication and scope controls for MCP servers will become an explicit audit question within the next regulatory cycle.