Agents and application controls

Use Artifact Analysis or another tool to scan for vulnerabilities in images and packages within Artifact Registry.

If you use a third-party scanning tool, you must deploy these tools correctly to scan Artifact Registry for vulnerabilities in images and packages.

The cloudbuild.allowedWorkerPools list constraint lets you define the permitted private pools that you can use within your organization, folder, or project.

Use one of the following formats to define an allowed or denied list of Worker Pools:

• under:organizations/ORGANIZATION_ID
• under:folders/FOLDER_ID
• under:projects/PROJECT_ID
• projects/PROJECT_ID/locations/REGION/workerPools/WORKER_POOL_ID

The cloudbuild.allowedIntegrations constraint defines which external services (for example, GitHub) can invoke build triggers. For example, if your build trigger listens for changes to a GitHub repository and GitHub is denied in this constraint, your trigger won't run. You can specify any number of allowed or denied values for your organization or project.

Enable Model Armor to screen for malicious or harmful content in natural language communications, including LLM prompts and responses, MCP server-client connections, or agentic communications.

Automatically scan the container operating systems and language packages in your running workloads for known vulnerabilities to get actionable mitigation strategies.

Cleanup policies are useful if you store many versions of your artifacts but only need to keep specific versions that you release to production. Create separate cleanup policies for deleting artifacts and retaining artifacts.