This page lists the IAM roles and permissions for Model Armor. To search through all roles and permissions, see the role and permission index .
Model Armor roles
Model Armor Admin
( roles/
)
Grants full access to all modelarmor resources. Intended for administrators & owners.
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
modelarmor.templates.*
-
modelarmor.templates.create -
modelarmor.templates.delete -
modelarmor.templates.get -
modelarmor.templates.list -
modelarmor.templates.update -
modelarmor.templates. useToSanitizeInput -
modelarmor.templates. useToSanitizeModelResponse -
modelarmor.templates. useToSanitizeOutput -
modelarmor.templates. useToSanitizeUserPrompt -
modelarmor.templates. useToStreamSanitizeModelResponse -
modelarmor.templates. useToStreamSanitizeUserPrompt
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor Editor
( roles/
)
Editor role for Model Armor resources.
modelarmor.callouts.invoke
modelarmor.
modelarmor.floorSettings.get
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
modelarmor.templates.*
-
modelarmor.templates.create -
modelarmor.templates.delete -
modelarmor.templates.get -
modelarmor.templates.list -
modelarmor.templates.update -
modelarmor.templates. useToSanitizeInput -
modelarmor.templates. useToSanitizeModelResponse -
modelarmor.templates. useToSanitizeOutput -
modelarmor.templates. useToSanitizeUserPrompt -
modelarmor.templates. useToStreamSanitizeModelResponse -
modelarmor.templates. useToStreamSanitizeUserPrompt
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor Viewer
( roles/
)
Grants read access to all model armor resources. Intended for viewers.
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
modelarmor.templates.get
modelarmor.templates.list
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor Callout User Beta
( roles/
)
Grants access to use Model Armor Callout service. Intended for users & applications which plan to use Model Armor Callout service.
modelarmor.callouts.invoke
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor Floor Setting Admin
( roles/
)
Grants full access to all Model Armor Floor Setting resources. Intended for administrators & owners.
modelarmor.floorSettings.*
-
modelarmor.floorSettings. computeEffectiveFloorSetting -
modelarmor.floorSettings.get -
modelarmor.floorSettings. update
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor Floor Setting Viewer
( roles/
)
Grants read access to all Model Armor Floor Setting resources. Intended for viewers.
modelarmor.floorSettings.get
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
resourcemanager.folders.get
resourcemanager.folders.list
resourcemanager.
resourcemanager.projects.get
resourcemanager.projects.list
Model Armor User
( roles/
)
Grants access to sanitize APIs for templates. Intended for users & applications which plan to use a template.
modelarmor.locations.*
-
modelarmor.locations.get -
modelarmor.locations.list
modelarmor.
modelarmor.
modelarmor.
modelarmor.
modelarmor.
modelarmor.
resourcemanager.projects.get
resourcemanager.projects.list
Service agent roles
Service agent roles should only be granted to service agents .
Model Armor Service Agent
( roles/
)
Gives Model Armor Service Account permission to make DLP calls.
dlp.analyzeRiskTemplates.get
dlp.analyzeRiskTemplates.list
dlp.deidentifyTemplates.get
dlp.deidentifyTemplates.list
dlp.inspectFindings.list
dlp.inspectTemplates.get
dlp.inspectTemplates.list
dlp.jobTriggers.get
dlp.jobTriggers.list
dlp.jobs.get
dlp.jobs.list
dlp.kms.encrypt
dlp.locations.*
-
dlp.locations.get -
dlp.locations.list
dlp.storedInfoTypes.get
dlp.storedInfoTypes.list
serviceusage.services.use
Model Armor permissions
modelarmor.callouts.invoke
Owner
( roles/
)
Editor
( roles/
)
Model Armor Editor
( roles/
)
Model Armor Callout User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Support User
( roles/
)
Model Armor Floor Setting Admin
( roles/
)
modelarmor.floorSettings.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Support User
( roles/
)
Model Armor Floor Setting Admin
( roles/
)
Model Armor Floor Setting Viewer
( roles/
)
modelarmor.
Owner
( roles/
)
Security Center Admin
( roles/
)
Model Armor Floor Setting Admin
( roles/
)
modelarmor.locations.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Model Armor Viewer
( roles/
)
Security Center Admin
( roles/
)
Support User
( roles/
)
Model Armor Callout User
( roles/
)
Model Armor Floor Setting Admin
( roles/
)
Model Armor Floor Setting Viewer
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent
modelarmor.locations.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Model Armor Viewer
( roles/
)
Security Center Admin
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
Model Armor Callout User
( roles/
)
Model Armor Floor Setting Admin
( roles/
)
Model Armor Floor Setting Viewer
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent
modelarmor.templates.create
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
modelarmor.templates.delete
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
modelarmor.templates.get
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Model Armor Viewer
( roles/
)
Security Center Admin
( roles/
)
Support User
( roles/
)
modelarmor.templates.list
Owner
( roles/
)
Editor
( roles/
)
Viewer
( roles/
)
Security Admin
( roles/
)
Security Reviewer
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Model Armor Viewer
( roles/
)
Security Center Admin
( roles/
)
Security Auditor
( roles/
)
Support User
( roles/
)
modelarmor.templates.update
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent - Discovery Engine Service Agent
(
roles/)discoveryengine.serviceAgent
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
Service agent roles
- Vertex AI Reasoning Engine Service Agent
(
roles/)aiplatform.reasoningEngineServiceAgent - Discovery Engine Service Agent
(
roles/)discoveryengine.serviceAgent
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
modelarmor.
Owner
( roles/
)
Editor
( roles/
)
Model Armor Admin
( roles/
)
Model Armor Editor
( roles/
)
Security Center Admin
( roles/
)
Model Armor User
( roles/
)
