7 skills · sorted by relevance
Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.
Inspect and manage Google Cloud IAM policies that grant roles or explicitly deny permissions. The skill prepares policy changes for user approval, supports organization, folder, project, and supported resource scopes, and verifies the resulting policy after execution.
Manage temporary access in Google Cloud with Privileged Access Manager. Configure who can request which roles and for how long, maintain access configurations, and handle access requests and approval decisions through guided workflows.
Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.
The English summary is being prepared. Showing the original description.
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, request temporary access, or approve/deny pending PAM grants. Do NOT use for permanent IAM policy bindings, troubleshooting IAM permission errors, or general Google Cloud resource provisioning.
The English summary is being prepared. Showing the original description.
Streamlines the creation, modification, and management of IAM allow policies (v1) and deny policies (v2). Manages access control across Resource Manager resources (Organization, Folder, Project) and individual resources. Use when creating, updating, listing, or deleting IAM allow policies or deny policies. Don't use for access denial troubleshooting (use iam-helper-for-troubleshooting), temporary privileged access (use iam-helper-for-privileged-access-management), configuring VPC Service Controls, or managing network firewall rules.
The English summary is being prepared. Showing the original description.
Use when an assignment must expire on a date, not stand forever. Trigger keywords: permission set expiration date, permission set group expiry, temporary access, time-boxed elevation, contractor access, ExpirationDate. NOT for PSG composition - use admin/permission-set-group-composition. NOT for muting mechanics - use security/permission-set-groups-and-muting. NOT for criteria-based auto-assignment - use admin/user-access-policies.
The English summary is being prepared. Showing the original description.