[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698ZFFK5XPDWPA6T7600MNE":3,"skill-same:01M698ZFFK5XPDWPA6T7600MNE":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M698ZFFK5XPDWPA6T7600MNE","assured-workloads-basics",null,"Provisions, inspects, updates, and deletes Google Cloud Assured Workloads V1 compliant folders, CMEK settings, Sovereign Controls by Partners, and service usage restrictions. Use when creating, listing, describing, updating, or deleting an Assured Workloads workload for any compliance regime or data boundary (FedRAMP, DoD IL2\u002FIL4\u002FIL5, ITAR, CJIS, Healthcare, Sovereign Controls by Partners, or Regional Data Boundaries). Don't use for brownfield assessments or custom frameworks (use assuredworkloads-environment-assessor or assuredworkloads-frameworks-*), or non-compliant folders.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,9,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"assured workloads basics","basics","listing","when","assessor","custom","for","v1","updates","usage","controls","dod","brownfield","frameworks","use","environment","healthcare","fedramp","data","partners","workload","security","google cloud","2026-11-10 10:12:30",false,"---\nname: assured-workloads-basics\ndescription: >-\n  Provisions, inspects, updates, and deletes Google Cloud Assured Workloads V1\n  compliant folders, CMEK settings, Sovereign Controls by Partners, and service\n  usage restrictions. Use when creating, listing, describing, updating, or\n  deleting an Assured Workloads workload for any compliance regime or data boundary\n  (FedRAMP, DoD IL2\u002FIL4\u002FIL5, ITAR, CJIS, Healthcare, Sovereign Controls by\n  Partners, or Regional Data Boundaries). Don't use for brownfield assessments\n  or custom frameworks (use assuredworkloads-environment-assessor or\n  assuredworkloads-frameworks-*), or non-compliant folders.\nmetadata:\n  version: \"1.0.1\"\n  category: Security\n---\n\n# Google Cloud Assured Workloads Basics (V1 GA)\n\nValidate prerequisites, create Assured Workloads V1 compliant folders, allowlist compliant services, and list, inspect, update, or delete existing workloads using `gcloud` and the Google Cloud Python Client Libraries (`google-cloud-assured-workloads` and `google-api-python-client`).\n\n## Usage Attribution\n\nFor all `gcloud` CLI, REST API, and MCP attribution requirements when executing commands with this skill, follow the instructions in [Usage Attribution](references\u002Fattribution.md).\n\n## Mandatory Guardrails\n\n1. **No Fabrication:** Never invent Organization IDs, Billing Account IDs, Folder IDs, Project IDs, Workload IDs, or Compliance Regime enums. Validate parameters with `scripts\u002Fvalidate_params.py` before running commands.\n2. **Regional \u002F Multi-Regional Locations & CLI Surface:** Assured Workloads V1 does **not** support `--location=global`; always use a regional or multi-regional location compatible with the compliance regime (see [references\u002Fregimes.md](references\u002Fregimes.md)). Never use `gcloud compliance-manager` commands for Assured Workloads V1 workloads.\n3. **Human Confirmation Before Mutation:** Read-only operations (`list`, `describe`, and `scripts\u002Fmanage_workload_updates.py --action=list`) can run immediately after validation, but you **must** obtain explicit user confirmation before executing any mutating or destructive command (`create`, `restrict_allowed_resources.py`, `update`, `manage_workload_updates.py --action=apply`, `delete`, `folders delete`, or `projects delete`).\n4. **Telemetry Attribution & Regional Endpoints:**\n   * Prefix every `gcloud` command you execute directly with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:assured-workloads-basics)\"` (see [Usage Attribution](references\u002Fattribution.md)).\n   * Configure Python GAPIC and Discovery clients with regional `ClientOptions(api_endpoint=\"{location}-assuredworkloads.googleapis.com\")`.\n\n## Step 0: Prerequisites & Environment Setup\n\nVerify these 5 prerequisites before running Assured Workloads operations:\n\n1. **CLI & Python Libraries:** Install the Google Cloud SDK (`gcloud` — see the [Google Cloud SDK Installation Guide](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt)) and Python client libraries:\n   ```bash\n   pip install \"google-cloud-assured-workloads>=1.0,\u003C2\" \"google-api-python-client>=2.0,\u003C3\" \"google-auth>=2.0,\u003C3\"\n   ```\n2. **Dual Authentication (CLI + ADC):** Authenticate both `gcloud` and Application Default Credentials (`gcloud auth login && gcloud auth application-default login`, or `gcloud auth activate-service-account --key-file=\u002Fpath\u002Fto\u002Fkey.json` + `export GOOGLE_APPLICATION_CREDENTIALS=\"\u002Fpath\u002Fto\u002Fkey.json\"`).\n3. **Quota & Admin Project:** `gcloud config set project {admin_project_id}` and `gcloud auth application-default set-quota-project {admin_project_id}`.\n4. **API Enablement:** Enable the Assured Workloads API (`assuredworkloads.googleapis.com`):\n   ```bash\n   gcloud services enable assuredworkloads.googleapis.com --project={admin_project_id}\n   ```\n5. **Organization-Level IAM Roles (`organizations\u002F{org_id}`):**\n   * **Caller:** `roles\u002Fassuredworkloads.admin` (or `roles\u002Fassuredworkloads.reader` \u002F `roles\u002Fassuredworkloads.editor` for read-only `list`\u002F`describe`), `roles\u002Fresourcemanager.organizationViewer`, and `roles\u002Fbilling.user` on `--billing-account=billingAccounts\u002F{billing_id}` when creating workloads (plus `billing.resourceAssociations.create` on `--partner-services-billing-account` for partner workloads).\n   * **Assured Workloads Service Agent (`service-{org_number}@gcp-sa-assuredworkloads.iam.gserviceaccount.com`):** `roles\u002Fassuredworkloads.serviceAgent`.\n\n## Workflow 1: Create an Assured Workloads workload (Two-Phase Provisioning)\n\n### Phase 1: Validate Parameters & Create Workload (`gcloud assured workloads create`)\n\n1. **Select Regime & Location:** Check [references\u002Fregimes.md](references\u002Fregimes.md) for all 45 V1 `--compliance-regime` enums and valid `--location` values.\n   * **Free-Tier Regional Data Boundaries (`REGIONAL_DATA_BOUNDARY`):** Free-tier regional data boundaries (e.g., *US Data Boundary* with standard commercial support and without sovereign personnel support uplift, *EU Data Boundary*, *Australia\u002FIndia\u002FUK\u002FCanada\u002FIsrael Data Boundary*) map to `--compliance-regime=REGIONAL_DATA_BOUNDARY` (legacy alias: `REGIONAL_CONTROLS`) paired with `--location={location}` (except Japan, which uses `JAPAN_DATA_BOUNDARY`). Do **not** set `--compliance-regime` to paid sovereign support regimes (`US_REGIONS_AND_US_SUPPORT`, `US_DATA_BOUNDARY_AND_SUPPORT`, `FEDRAMP_MODERATE`) when the user requests the free-tier boundary, and never invent non-existent enums like `US_DATA_BOUNDARY`.\n2. **Billing Account Discovery (If Omitted):** Never guess a billing account ID. If omitted, run `gcloud billing accounts list --filter=\"open=true\" --format=\"table(name,displayName)\"` or ask the user for `billingAccounts\u002F{billing_id}`.\n3. **Validate & Create:** Validate with `python3 scripts\u002Fvalidate_params.py --operation=create ...`, surface any warnings, obtain explicit user confirmation, and execute `gcloud assured workloads create`:\n   ```bash\n   gcloud assured workloads create \\\n     --organization={org_id} --location={location} \\\n     --display-name=\"{display_name}\" --compliance-regime={compliance_regime} \\\n     --billing-account=billingAccounts\u002F{billing_id} \\\n     [--provisioned-resources-parent=folders\u002F{parent_folder_id}] [--enable-sovereign-controls] \\\n     [--next-rotation-time={next_rotation_time} --rotation-period={rotation_seconds}s] \\\n     [--resource-settings=consumer-project-id={consumer_project_id},consumer-project-name={consumer_project_name},encryption-keys-project-id={kms_project_id},encryption-keys-project-name={kms_project_name},keyring-id={keyring_id}] \\\n     [--partner={partner_enum}] [--partner-permissions=data-logs-viewer=true|false] \\\n     [--partner-services-billing-account=billingAccounts\u002F{partner_billing_id}] \\\n     [--labels=key1=val1,key2=val2] [--external-identifier={external_id}] --format=json\n   ```\n   * **CMEK & Resource Settings Rules:** `--next-rotation-time` (RFC 3339 timestamp) and `--rotation-period` (seconds, e.g. `172800s`) must be specified together. `encryption-keys-project-id`, `encryption-keys-project-name`, and `keyring-id` in `--resource-settings` require both rotation flags.\n   * **Sovereign Controls by Partners (`--compliance-regime=ASSURED_WORKLOADS_FOR_PARTNERS`):**\n     * Requests for partner-managed sovereign controls (S3NS, T-Systems, SIA Minsait, PSN, CNTXT, Telefónica) map to `--compliance-regime=ASSURED_WORKLOADS_FOR_PARTNERS`.\n     * Requires `--partner` and a supported partner region (see [references\u002Fregimes.md](references\u002Fregimes.md) for valid `--partner` values, supported regions, and partner billing account requirements).\n     * Configure partner permissions on the CLI with `--partner-permissions=data-logs-viewer=true` (or `data-logs-viewer=false`).\n\n### Phase 2 (Optional): Allowlist Compliant Services \u002F Enable BigQuery (`google-cloud-assured-workloads`)\n\n* **When Required:** For `FEDRAMP_MODERATE` and `DATA_BOUNDARY_FOR_FEDRAMP_MODERATE`, BigQuery is automatically enabled at creation (skip Phase 2). For all other regimes (such as `FEDRAMP_HIGH`), BigQuery is initially blocked by the folder's `constraints\u002Fgcp.restrictServiceUsage` organization policy while a background configuration process completes (typically 5–10 minutes after creation).\n* **Never Bypass Org Policies Manually:** Do **not** manually override or delete `constraints\u002Fgcp.restrictServiceUsage` on the folder to bypass Assured Workloads compliance controls.\n* **Programmatic Allowlisting (`AssuredWorkloadsServiceClient.restrict_allowed_resources`):** Once background setup completes and compliant services (like BigQuery) appear in `compliantButDisallowedServices`, run `python3 scripts\u002Frestrict_allowed_resources.py --organization={org_id} --location={location} --workload-id={workload_id} --restriction-type=ALLOW_COMPLIANT_RESOURCES` (after user confirmation), or call the official `google-cloud-assured-workloads` Python client library directly:\n  ```python\n  from google.api_core.client_options import ClientOptions\n  from google.cloud import assuredworkloads_v1\n\n  client = assuredworkloads_v1.AssuredWorkloadsServiceClient(\n      client_options=ClientOptions(\n          api_endpoint=f\"{location}-assuredworkloads.googleapis.com\"\n      ),\n      transport=\"rest\",\n  )\n  request = assuredworkloads_v1.RestrictAllowedResourcesRequest(\n      name=f\"organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}\",\n      restriction_type=assuredworkloads_v1.RestrictAllowedResourcesRequest.RestrictionType.ALLOW_COMPLIANT_RESOURCES,\n  )\n  client.restrict_allowed_resources(request=request)\n  ```\n  *(Supported `RestrictionType` values: `ALLOW_COMPLIANT_RESOURCES`, `APPEND_COMPLIANT_RESOURCES`, or `ALLOW_ALL_GCP_RESOURCES`).*\n\n## Workflow 2: List & Describe Assured Workloads workloads (`gcloud`)\n\nRead-only `list` and `describe` operations do not require user confirmation after validating with `scripts\u002Fvalidate_params.py`.\n\n1. **List Workloads (`ListWorkloads`):**\n   ```bash\n   gcloud assured workloads list --organization={org_id} --location={location} \\\n     [--filter=\"{filter_expression}\"] [--limit={limit}] [--page-size={page_size}] --format=json\n   ```\n2. **Describe a Specific Workload (`GetWorkload`):**\n   ```bash\n   gcloud assured workloads describe {workload_id} --organization={org_id} --location={location} --format=json\n   ```\n   *(Or pass the full resource name `organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}`).*\n   * **Key `describe` Output Fields:** `name`, `displayName`, `complianceRegime`, `partner`, `resources` (provisioned `CONSUMER_FOLDER` folder ID, `CONSUMER_PROJECT`, `ENCRYPTION_KEYS_PROJECT`, and `KEYRING`), `etag` (optimistic concurrency token required for `update`\u002F`delete`), `compliantButDisallowedServices`, `kajEnrollmentState`, `saaEnrollmentResponse`, `violationNotificationsEnabled`, and `labels`.\n\n## Workflow 3: Delete an Assured Workloads workload (`DeleteWorkload`)\n\nAn Assured Workloads workload **cannot** be deleted while its provisioned Cloud Resource Manager folder (`folders\u002F{folder_id}`) or child projects still exist (`FAILED_PRECONDITION: Workload is not empty` \u002F `ERROR_CODE_WORKLOAD_NOT_EMPTY`). Never run `gcloud assured workloads delete` before deleting the provisioned folder and its child projects.\n\n1. **Inspect & Validate:** Run `gcloud assured workloads describe` to identify the provisioned folder (`folders\u002F{folder_id}`) and child projects (`{project_id}`), and validate with `python3 scripts\u002Fvalidate_params.py --operation=delete --workload-id={workload_id} --organization={org_id} --location={location}`.\n2. **Confirm & Execute Ordered Deletion Sequence:** Obtain explicit user confirmation, then run in strict bottom-up order:\n   ```bash\n   # Step 1: Delete child projects inside the workload folder first\n   gcloud projects delete {project_id} --quiet\n\n   # Step 2: Delete the provisioned Assured Workloads folder\n   gcloud resource-manager folders delete {folder_id}\n\n   # Step 3: Delete the Assured Workloads workload after folder deletion propagates\n   gcloud assured workloads delete {workload_id} --organization={org_id} --location={location} --quiet\n   ```\n   * **Propagation Delay & `--etag` Note:** Folder deletion state (`DELETE_REQUESTED`) can take a brief propagation delay (15–60s) before Assured Workloads recognizes the folder as deleted. If `ERROR_CODE_WORKLOAD_NOT_EMPTY` transiently persists after deleting the folder, wait 15–20 seconds and retry `gcloud assured workloads delete` **without** a stale `--etag` (as deleting underlying resources changes the workload's concurrency token).\n\n## Workflow 4: Update an Assured Workloads workload (`UpdateWorkload` & Compliance Updates)\n\n### 4A. Update Workload Metadata & Notifications (`gcloud assured workloads update`)\n\n* **Updatable Fields (at least one required):**\n  * `--display-name=\"{new_display_name}\"`: 4–30 characters (`[a-zA-Z0-9 -]`, no trailing spaces).\n  * `--labels=key1=val1,key2=val2`: Replaces the workload's label map (include existing labels to preserve them).\n  * `--violation-notifications-enabled=true|false`: Enables or disables email notifications for organization policy compliance violations to Essential Contacts (Legal category).\n  * `--etag={etag}`: Current concurrency token from `describe`\u002F`list`.\n* **Immutable Fields (Cannot Be Modified After Creation):** `complianceRegime`, `location`, `billingAccount`, and `partner` are immutable. `gcloud assured workloads update` **cannot** change a workload's `complianceRegime` or `location` in-place; changing regimes requires creating a new Assured Workloads workload.\n* **Validate, Confirm, & Execute:** Validate with `python3 scripts\u002Fvalidate_params.py --operation=update ...`, obtain explicit user confirmation, and run:\n  ```bash\n  gcloud assured workloads update {workload_id} --organization={org_id} --location={location} \\\n    [--display-name=\"{new_display_name}\"] [--labels=key1=val1,key2=val2] \\\n    [--violation-notifications-enabled=true|false] [--etag={etag}] --format=json\n  ```\n\n### 4B. List & Apply Compliance Posture Updates (`updates.list` & `updates.apply`)\n\n`gcloud assured workloads` does **not** have a built-in CLI subcommand to list or apply compliance posture updates from the `updates` sub-resource (`gcloud assured workloads update` only updates workload metadata). Use `scripts\u002Fmanage_workload_updates.py` (`--action=list` or `--action=apply` after user confirmation) or `googleapiclient.discovery.build` against the regional Assured Workloads v1 API (`https:\u002F\u002F{location}-assuredworkloads.googleapis.com`):\n\n* **`AVAILABLE` vs. `WITHDRAWN` Update States:**\n  * **`AVAILABLE` (One Update Per Constraint):** Each `AVAILABLE` update record corresponds to an individual organization policy constraint update (`details.orgPolicyUpdate.suggestedPolicy.constraint`). If multiple updates are `AVAILABLE`, each corresponds to a different constraint and must be applied individually (or sequentially via `--update-id=ALL`)—applying the newest update does **not** apply older `AVAILABLE` updates for other constraints.\n  * **`WITHDRAWN` (Superseded):** When a newer policy update supersedes an older unapplied update for the same constraint, Assured Workloads marks the older update `WITHDRAWN`. Filter for state `AVAILABLE` and never apply `WITHDRAWN` updates.\n* **Python Discovery API Pattern (`updates.list`, `updates.apply`, & LRO Polling):**\n  ```python\n  import time\n  from google.api_core.client_options import ClientOptions\n  from googleapiclient import discovery\n\n  service = discovery.build(\n      \"assuredworkloads\",\n      \"v1\",\n      client_options=ClientOptions(\n          api_endpoint=f\"https:\u002F\u002F{location}-assuredworkloads.googleapis.com\"\n      ),\n  )\n  parent = f\"organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}\"\n\n  # 1. List updates and filter for AVAILABLE state\n  resp = (\n      service.organizations()\n      .locations()\n      .workloads()\n      .updates()\n      .list(parent=parent)\n      .execute()\n  )\n  available = [u for u in resp.get(\"updates\", []) if u.get(\"state\") == \"AVAILABLE\"]\n\n  # 2. Apply each AVAILABLE update and poll the returned Long-Running Operation (LRO)\n  for update in available:\n    op = (\n        service.organizations()\n        .locations()\n        .workloads()\n        .updates()\n        .apply(name=update[\"name\"], body={})\n        .execute()\n    )\n    while not op.get(\"done\", False):\n      time.sleep(3)\n      op = (\n          service.organizations()\n          .locations()\n          .operations()\n          .get(name=op[\"name\"])\n          .execute()\n      )\n  ```\n\n## Common Error Handling & Troubleshooting (`scripts\u002Fdiagnose_error.py`)\n\nNever blindly retry deterministic `400 INVALID_ARGUMENT`, `403 PERMISSION_DENIED`, `404 NOT_FOUND`, or `FAILED_PRECONDITION` errors. Run `python3 scripts\u002Fdiagnose_error.py --error-message=\"{error_output_text}\"` to match any error against the full Assured Workloads `ErrorInfo.reason` catalog.\n\n### Troubleshooting `Folder creation was unsuccessful. Please try again.` (LRO Inspection)\n\nWhen `gcloud assured workloads create` fails with the generic message `Folder creation was unsuccessful. Please try again.`, do **not** blindly retry. Inspect the failed Long-Running Operation (LRO) in the same organization and location to retrieve the specific `ErrorInfo.reason`:\n```bash\ngcloud assured operations list --organization={org_id} --location={location} --format=json\ngcloud assured operations describe {operation_id} --organization={org_id} --location={location} --format=json\n```\n*(Or run `python3 scripts\u002Fdiagnose_error.py --fetch-latest-lro --organization={org_id} --location={location}`).*\n\n**Common Folder Creation Preconditions to Check in the LRO Error:**\n* **Duplicate sibling folder display name (`ERROR_CODE_FOLDER_NAME_UNIQUENESS`):** A sibling folder with the same `--display-name` already exists under the target parent (`organizations\u002F{org_id}` or `folders\u002F{parent_folder_id}`). Choose a unique `--display-name` or a different `--provisioned-resources-parent`.\n* **Nesting inside an existing Assured Workloads folder (`ERROR_CODE_INVALID_PROVISIONED_RESOURCES_PARENT`):** Assured Workloads folders cannot be nested inside another Assured Workloads folder. Specify a standard non-workload parent folder or omit `--provisioned-resources-parent`.\n* **Folder quota or nesting depth limit (`ERROR_CODE_FOLDER_CREATION_PRECONDITION_FAILED`):** The target parent reached the Cloud Resource Manager 300 direct child-folder quota or the 10-level folder nesting depth limit.\n\n## Reference Documentation\n\n* **[references\u002Fregimes.md](references\u002Fregimes.md):** Complete table of all 45 Assured Workloads V1 compliance regimes, modern `DATA_BOUNDARY_FOR_*` enums, legacy aliases, partner enums, and supported regional\u002Fmulti-regional locations.\n* **Official Google Cloud Documentation:** [Assured Workloads Overview](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Foverview.md.txt), [Supported Locations & Data Boundaries](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Flocations.md.txt), [Assured Workloads Pricing](https:\u002F\u002Fcloud.google.com\u002Fassured-workloads\u002Fpricing), [Apply Workload Updates](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Fapply-updates.md.txt), [Sovereign Controls by Partners Overview](https:\u002F\u002Fcloud.google.com\u002Fsovereign-controls-by-partners\u002Fdocs\u002Foverview), [Sovereign Controls by Partners Locations](https:\u002F\u002Fcloud.google.com\u002Fsovereign-controls-by-partners\u002Fdocs\u002Flocations).\n","# Google Cloud Assured Workloads Basics (V1 GA)\n\nValidate prerequisites, create Assured Workloads V1 compliant folders, allowlist compliant services, and list, inspect, update, or delete existing workloads using `gcloud` and the Google Cloud Python Client Libraries (`google-cloud-assured-workloads` and `google-api-python-client`).\n\n## Usage Attribution\n\nFor all `gcloud` CLI, REST API, and MCP attribution requirements when executing commands with this skill, follow the instructions in [Usage Attribution](references\u002Fattribution.md).\n\n## Mandatory Guardrails\n\n1. **No Fabrication:** Never invent Organization IDs, Billing Account IDs, Folder IDs, Project IDs, Workload IDs, or Compliance Regime enums. Validate parameters with `scripts\u002Fvalidate_params.py` before running commands.\n2. **Regional \u002F Multi-Regional Locations & CLI Surface:** Assured Workloads V1 does **not** support `--location=global`; always use a regional or multi-regional location compatible with the compliance regime (see [references\u002Fregimes.md](references\u002Fregimes.md)). Never use `gcloud compliance-manager` commands for Assured Workloads V1 workloads.\n3. **Human Confirmation Before Mutation:** Read-only operations (`list`, `describe`, and `scripts\u002Fmanage_workload_updates.py --action=list`) can run immediately after validation, but you **must** obtain explicit user confirmation before executing any mutating or destructive command (`create`, `restrict_allowed_resources.py`, `update`, `manage_workload_updates.py --action=apply`, `delete`, `folders delete`, or `projects delete`).\n4. **Telemetry Attribution & Regional Endpoints:**\n   * Prefix every `gcloud` command you execute directly with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:assured-workloads-basics)\"` (see [Usage Attribution](references\u002Fattribution.md)).\n   * Configure Python GAPIC and Discovery clients with regional `ClientOptions(api_endpoint=\"{location}-assuredworkloads.googleapis.com\")`.\n\n## Step 0: Prerequisites & Environment Setup\n\nVerify these 5 prerequisites before running Assured Workloads operations:\n\n1. **CLI & Python Libraries:** Install the Google Cloud SDK (`gcloud` — see the [Google Cloud SDK Installation Guide](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt)) and Python client libraries:\n   ```bash\n   pip install \"google-cloud-assured-workloads>=1.0,\u003C2\" \"google-api-python-client>=2.0,\u003C3\" \"google-auth>=2.0,\u003C3\"\n   ```\n2. **Dual Authentication (CLI + ADC):** Authenticate both `gcloud` and Application Default Credentials (`gcloud auth login && gcloud auth application-default login`, or `gcloud auth activate-service-account --key-file=\u002Fpath\u002Fto\u002Fkey.json` + `export GOOGLE_APPLICATION_CREDENTIALS=\"\u002Fpath\u002Fto\u002Fkey.json\"`).\n3. **Quota & Admin Project:** `gcloud config set project {admin_project_id}` and `gcloud auth application-default set-quota-project {admin_project_id}`.\n4. **API Enablement:** Enable the Assured Workloads API (`assuredworkloads.googleapis.com`):\n   ```bash\n   gcloud services enable assuredworkloads.googleapis.com --project={admin_project_id}\n   ```\n5. **Organization-Level IAM Roles (`organizations\u002F{org_id}`):**\n   * **Caller:** `roles\u002Fassuredworkloads.admin` (or `roles\u002Fassuredworkloads.reader` \u002F `roles\u002Fassuredworkloads.editor` for read-only `list`\u002F`describe`), `roles\u002Fresourcemanager.organizationViewer`, and `roles\u002Fbilling.user` on `--billing-account=billingAccounts\u002F{billing_id}` when creating workloads (plus `billing.resourceAssociations.create` on `--partner-services-billing-account` for partner workloads).\n   * **Assured Workloads Service Agent (`service-{org_number}@gcp-sa-assuredworkloads.iam.gserviceaccount.com`):** `roles\u002Fassuredworkloads.serviceAgent`.\n\n## Workflow 1: Create an Assured Workloads workload (Two-Phase Provisioning)\n\n### Phase 1: Validate Parameters & Create Workload (`gcloud assured workloads create`)\n\n1. **Select Regime & Location:** Check [references\u002Fregimes.md](references\u002Fregimes.md) for all 45 V1 `--compliance-regime` enums and valid `--location` values.\n   * **Free-Tier Regional Data Boundaries (`REGIONAL_DATA_BOUNDARY`):** Free-tier regional data boundaries (e.g., *US Data Boundary* with standard commercial support and without sovereign personnel support uplift, *EU Data Boundary*, *Australia\u002FIndia\u002FUK\u002FCanada\u002FIsrael Data Boundary*) map to `--compliance-regime=REGIONAL_DATA_BOUNDARY` (legacy alias: `REGIONAL_CONTROLS`) paired with `--location={location}` (except Japan, which uses `JAPAN_DATA_BOUNDARY`). Do **not** set `--compliance-regime` to paid sovereign support regimes (`US_REGIONS_AND_US_SUPPORT`, `US_DATA_BOUNDARY_AND_SUPPORT`, `FEDRAMP_MODERATE`) when the user requests the free-tier boundary, and never invent non-existent enums like `US_DATA_BOUNDARY`.\n2. **Billing Account Discovery (If Omitted):** Never guess a billing account ID. If omitted, run `gcloud billing accounts list --filter=\"open=true\" --format=\"table(name,displayName)\"` or ask the user for `billingAccounts\u002F{billing_id}`.\n3. **Validate & Create:** Validate with `python3 scripts\u002Fvalidate_params.py --operation=create ...`, surface any warnings, obtain explicit user confirmation, and execute `gcloud assured workloads create`:\n   ```bash\n   gcloud assured workloads create \\\n     --organization={org_id} --location={location} \\\n     --display-name=\"{display_name}\" --compliance-regime={compliance_regime} \\\n     --billing-account=billingAccounts\u002F{billing_id} \\\n     [--provisioned-resources-parent=folders\u002F{parent_folder_id}] [--enable-sovereign-controls] \\\n     [--next-rotation-time={next_rotation_time} --rotation-period={rotation_seconds}s] \\\n     [--resource-settings=consumer-project-id={consumer_project_id},consumer-project-name={consumer_project_name},encryption-keys-project-id={kms_project_id},encryption-keys-project-name={kms_project_name},keyring-id={keyring_id}] \\\n     [--partner={partner_enum}] [--partner-permissions=data-logs-viewer=true|false] \\\n     [--partner-services-billing-account=billingAccounts\u002F{partner_billing_id}] \\\n     [--labels=key1=val1,key2=val2] [--external-identifier={external_id}] --format=json\n   ```\n   * **CMEK & Resource Settings Rules:** `--next-rotation-time` (RFC 3339 timestamp) and `--rotation-period` (seconds, e.g. `172800s`) must be specified together. `encryption-keys-project-id`, `encryption-keys-project-name`, and `keyring-id` in `--resource-settings` require both rotation flags.\n   * **Sovereign Controls by Partners (`--compliance-regime=ASSURED_WORKLOADS_FOR_PARTNERS`):**\n     * Requests for partner-managed sovereign controls (S3NS, T-Systems, SIA Minsait, PSN, CNTXT, Telefónica) map to `--compliance-regime=ASSURED_WORKLOADS_FOR_PARTNERS`.\n     * Requires `--partner` and a supported partner region (see [references\u002Fregimes.md](references\u002Fregimes.md) for valid `--partner` values, supported regions, and partner billing account requirements).\n     * Configure partner permissions on the CLI with `--partner-permissions=data-logs-viewer=true` (or `data-logs-viewer=false`).\n\n### Phase 2 (Optional): Allowlist Compliant Services \u002F Enable BigQuery (`google-cloud-assured-workloads`)\n\n* **When Required:** For `FEDRAMP_MODERATE` and `DATA_BOUNDARY_FOR_FEDRAMP_MODERATE`, BigQuery is automatically enabled at creation (skip Phase 2). For all other regimes (such as `FEDRAMP_HIGH`), BigQuery is initially blocked by the folder's `constraints\u002Fgcp.restrictServiceUsage` organization policy while a background configuration process completes (typically 5–10 minutes after creation).\n* **Never Bypass Org Policies Manually:** Do **not** manually override or delete `constraints\u002Fgcp.restrictServiceUsage` on the folder to bypass Assured Workloads compliance controls.\n* **Programmatic Allowlisting (`AssuredWorkloadsServiceClient.restrict_allowed_resources`):** Once background setup completes and compliant services (like BigQuery) appear in `compliantButDisallowedServices`, run `python3 scripts\u002Frestrict_allowed_resources.py --organization={org_id} --location={location} --workload-id={workload_id} --restriction-type=ALLOW_COMPLIANT_RESOURCES` (after user confirmation), or call the official `google-cloud-assured-workloads` Python client library directly:\n  ```python\n  from google.api_core.client_options import ClientOptions\n  from google.cloud import assuredworkloads_v1\n\n  client = assuredworkloads_v1.AssuredWorkloadsServiceClient(\n      client_options=ClientOptions(\n          api_endpoint=f\"{location}-assuredworkloads.googleapis.com\"\n      ),\n      transport=\"rest\",\n  )\n  request = assuredworkloads_v1.RestrictAllowedResourcesRequest(\n      name=f\"organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}\",\n      restriction_type=assuredworkloads_v1.RestrictAllowedResourcesRequest.RestrictionType.ALLOW_COMPLIANT_RESOURCES,\n  )\n  client.restrict_allowed_resources(request=request)\n  ```\n  *(Supported `RestrictionType` values: `ALLOW_COMPLIANT_RESOURCES`, `APPEND_COMPLIANT_RESOURCES`, or `ALLOW_ALL_GCP_RESOURCES`).*\n\n## Workflow 2: List & Describe Assured Workloads workloads (`gcloud`)\n\nRead-only `list` and `describe` operations do not require user confirmation after validating with `scripts\u002Fvalidate_params.py`.\n\n1. **List Workloads (`ListWorkloads`):**\n   ```bash\n   gcloud assured workloads list --organization={org_id} --location={location} \\\n     [--filter=\"{filter_expression}\"] [--limit={limit}] [--page-size={page_size}] --format=json\n   ```\n2. **Describe a Specific Workload (`GetWorkload`):**\n   ```bash\n   gcloud assured workloads describe {workload_id} --organization={org_id} --location={location} --format=json\n   ```\n   *(Or pass the full resource name `organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}`).*\n   * **Key `describe` Output Fields:** `name`, `displayName`, `complianceRegime`, `partner`, `resources` (provisioned `CONSUMER_FOLDER` folder ID, `CONSUMER_PROJECT`, `ENCRYPTION_KEYS_PROJECT`, and `KEYRING`), `etag` (optimistic concurrency token required for `update`\u002F`delete`), `compliantButDisallowedServices`, `kajEnrollmentState`, `saaEnrollmentResponse`, `violationNotificationsEnabled`, and `labels`.\n\n## Workflow 3: Delete an Assured Workloads workload (`DeleteWorkload`)\n\nAn Assured Workloads workload **cannot** be deleted while its provisioned Cloud Resource Manager folder (`folders\u002F{folder_id}`) or child projects still exist (`FAILED_PRECONDITION: Workload is not empty` \u002F `ERROR_CODE_WORKLOAD_NOT_EMPTY`). Never run `gcloud assured workloads delete` before deleting the provisioned folder and its child projects.\n\n1. **Inspect & Validate:** Run `gcloud assured workloads describe` to identify the provisioned folder (`folders\u002F{folder_id}`) and child projects (`{project_id}`), and validate with `python3 scripts\u002Fvalidate_params.py --operation=delete --workload-id={workload_id} --organization={org_id} --location={location}`.\n2. **Confirm & Execute Ordered Deletion Sequence:** Obtain explicit user confirmation, then run in strict bottom-up order:\n   ```bash\n   # Step 1: Delete child projects inside the workload folder first\n   gcloud projects delete {project_id} --quiet\n\n   # Step 2: Delete the provisioned Assured Workloads folder\n   gcloud resource-manager folders delete {folder_id}\n\n   # Step 3: Delete the Assured Workloads workload after folder deletion propagates\n   gcloud assured workloads delete {workload_id} --organization={org_id} --location={location} --quiet\n   ```\n   * **Propagation Delay & `--etag` Note:** Folder deletion state (`DELETE_REQUESTED`) can take a brief propagation delay (15–60s) before Assured Workloads recognizes the folder as deleted. If `ERROR_CODE_WORKLOAD_NOT_EMPTY` transiently persists after deleting the folder, wait 15–20 seconds and retry `gcloud assured workloads delete` **without** a stale `--etag` (as deleting underlying resources changes the workload's concurrency token).\n\n## Workflow 4: Update an Assured Workloads workload (`UpdateWorkload` & Compliance Updates)\n\n### 4A. Update Workload Metadata & Notifications (`gcloud assured workloads update`)\n\n* **Updatable Fields (at least one required):**\n  * `--display-name=\"{new_display_name}\"`: 4–30 characters (`[a-zA-Z0-9 -]`, no trailing spaces).\n  * `--labels=key1=val1,key2=val2`: Replaces the workload's label map (include existing labels to preserve them).\n  * `--violation-notifications-enabled=true|false`: Enables or disables email notifications for organization policy compliance violations to Essential Contacts (Legal category).\n  * `--etag={etag}`: Current concurrency token from `describe`\u002F`list`.\n* **Immutable Fields (Cannot Be Modified After Creation):** `complianceRegime`, `location`, `billingAccount`, and `partner` are immutable. `gcloud assured workloads update` **cannot** change a workload's `complianceRegime` or `location` in-place; changing regimes requires creating a new Assured Workloads workload.\n* **Validate, Confirm, & Execute:** Validate with `python3 scripts\u002Fvalidate_params.py --operation=update ...`, obtain explicit user confirmation, and run:\n  ```bash\n  gcloud assured workloads update {workload_id} --organization={org_id} --location={location} \\\n    [--display-name=\"{new_display_name}\"] [--labels=key1=val1,key2=val2] \\\n    [--violation-notifications-enabled=true|false] [--etag={etag}] --format=json\n  ```\n\n### 4B. List & Apply Compliance Posture Updates (`updates.list` & `updates.apply`)\n\n`gcloud assured workloads` does **not** have a built-in CLI subcommand to list or apply compliance posture updates from the `updates` sub-resource (`gcloud assured workloads update` only updates workload metadata). Use `scripts\u002Fmanage_workload_updates.py` (`--action=list` or `--action=apply` after user confirmation) or `googleapiclient.discovery.build` against the regional Assured Workloads v1 API (`https:\u002F\u002F{location}-assuredworkloads.googleapis.com`):\n\n* **`AVAILABLE` vs. `WITHDRAWN` Update States:**\n  * **`AVAILABLE` (One Update Per Constraint):** Each `AVAILABLE` update record corresponds to an individual organization policy constraint update (`details.orgPolicyUpdate.suggestedPolicy.constraint`). If multiple updates are `AVAILABLE`, each corresponds to a different constraint and must be applied individually (or sequentially via `--update-id=ALL`)—applying the newest update does **not** apply older `AVAILABLE` updates for other constraints.\n  * **`WITHDRAWN` (Superseded):** When a newer policy update supersedes an older unapplied update for the same constraint, Assured Workloads marks the older update `WITHDRAWN`. Filter for state `AVAILABLE` and never apply `WITHDRAWN` updates.\n* **Python Discovery API Pattern (`updates.list`, `updates.apply`, & LRO Polling):**\n  ```python\n  import time\n  from google.api_core.client_options import ClientOptions\n  from googleapiclient import discovery\n\n  service = discovery.build(\n      \"assuredworkloads\",\n      \"v1\",\n      client_options=ClientOptions(\n          api_endpoint=f\"https:\u002F\u002F{location}-assuredworkloads.googleapis.com\"\n      ),\n  )\n  parent = f\"organizations\u002F{org_id}\u002Flocations\u002F{location}\u002Fworkloads\u002F{workload_id}\"\n\n  # 1. List updates and filter for AVAILABLE state\n  resp = (\n      service.organizations()\n      .locations()\n      .workloads()\n      .updates()\n      .list(parent=parent)\n      .execute()\n  )\n  available = [u for u in resp.get(\"updates\", []) if u.get(\"state\") == \"AVAILABLE\"]\n\n  # 2. Apply each AVAILABLE update and poll the returned Long-Running Operation (LRO)\n  for update in available:\n    op = (\n        service.organizations()\n        .locations()\n        .workloads()\n        .updates()\n        .apply(name=update[\"name\"], body={})\n        .execute()\n    )\n    while not op.get(\"done\", False):\n      time.sleep(3)\n      op = (\n          service.organizations()\n          .locations()\n          .operations()\n          .get(name=op[\"name\"])\n          .execute()\n      )\n  ```\n\n## Common Error Handling & Troubleshooting (`scripts\u002Fdiagnose_error.py`)\n\nNever blindly retry deterministic `400 INVALID_ARGUMENT`, `403 PERMISSION_DENIED`, `404 NOT_FOUND`, or `FAILED_PRECONDITION` errors. Run `python3 scripts\u002Fdiagnose_error.py --error-message=\"{error_output_text}\"` to match any error against the full Assured Workloads `ErrorInfo.reason` catalog.\n\n### Troubleshooting `Folder creation was unsuccessful. Please try again.` (LRO Inspection)\n\nWhen `gcloud assured workloads create` fails with the generic message `Folder creation was unsuccessful. Please try again.`, do **not** blindly retry. Inspect the failed Long-Running Operation (LRO) in the same organization and location to retrieve the specific `ErrorInfo.reason`:\n```bash\ngcloud assured operations list --organization={org_id} --location={location} --format=json\ngcloud assured operations describe {operation_id} --organization={org_id} --location={location} --format=json\n```\n*(Or run `python3 scripts\u002Fdiagnose_error.py --fetch-latest-lro --organization={org_id} --location={location}`).*\n\n**Common Folder Creation Preconditions to Check in the LRO Error:**\n* **Duplicate sibling folder display name (`ERROR_CODE_FOLDER_NAME_UNIQUENESS`):** A sibling folder with the same `--display-name` already exists under the target parent (`organizations\u002F{org_id}` or `folders\u002F{parent_folder_id}`). Choose a unique `--display-name` or a different `--provisioned-resources-parent`.\n* **Nesting inside an existing Assured Workloads folder (`ERROR_CODE_INVALID_PROVISIONED_RESOURCES_PARENT`):** Assured Workloads folders cannot be nested inside another Assured Workloads folder. Specify a standard non-workload parent folder or omit `--provisioned-resources-parent`.\n* **Folder quota or nesting depth limit (`ERROR_CODE_FOLDER_CREATION_PRECONDITION_FAILED`):** The target parent reached the Cloud Resource Manager 300 direct child-folder quota or the 10-level folder nesting depth limit.\n\n## Reference Documentation\n\n* **[references\u002Fregimes.md](references\u002Fregimes.md):** Complete table of all 45 Assured Workloads V1 compliance regimes, modern `DATA_BOUNDARY_FOR_*` enums, legacy aliases, partner enums, and supported regional\u002Fmulti-regional locations.\n* **Official Google Cloud Documentation:** [Assured Workloads Overview](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Foverview.md.txt), [Supported Locations & Data Boundaries](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Flocations.md.txt), [Assured Workloads Pricing](https:\u002F\u002Fcloud.google.com\u002Fassured-workloads\u002Fpricing), [Apply Workload Updates](https:\u002F\u002Fdocs.cloud.google.com\u002Fassured-workloads\u002Fdocs\u002Fapply-updates.md.txt), [Sovereign Controls by Partners Overview](https:\u002F\u002Fcloud.google.com\u002Fsovereign-controls-by-partners\u002Fdocs\u002Foverview), [Sovereign Controls by Partners Locations](https:\u002F\u002Fcloud.google.com\u002Fsovereign-controls-by-partners\u002Fdocs\u002Flocations).\n",{"name":5,"metadata":52,"description":7},{"version":53,"category":54},"1.0.1","Security","main","071c4f7eba880767a647ce778650db8dbf7e16fc","skills\u002Fcloud\u002Fassured-workloads-basics",2005,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 01:51:35",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add google\u002Fskills --skill assured-workloads-basics",{"tool":70,"command":71},"bunx","bunx skills add google\u002Fskills --skill assured-workloads-basics",{"tool":73,"command":74},"pnpm","pnpm dlx skills add google\u002Fskills --skill assured-workloads-basics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002FSKILL.md",true,[78,84,88,94,98,102],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fattribution.md","REFERENCE","参考文档",1807,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Freferences\u002Fattribution.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fregimes.md",13987,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Freferences\u002Fregimes.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fdiagnose_error.py","SCRIPT","脚本",16783,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Fscripts\u002Fdiagnose_error.py",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fmanage_workload_updates.py",26769,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Fscripts\u002Fmanage_workload_updates.py",{"path":99,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Frestrict_allowed_resources.py",14156,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Fscripts\u002Frestrict_allowed_resources.py",{"path":103,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fvalidate_params.py",57538,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassured-workloads-basics\u002Fscripts\u002Fvalidate_params.py",[107,143,172,201,228,252],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":121,"publishedAt":47},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[113,118],{"categoryNo":114,"categoryName":115,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":119,"categoryName":120,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000010","后端与接口",[9,122,123,124,125,126,127,45,128,46,129,130,131,132,133,134,135,136,137,138,139,140,141,142],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":156,"publishedAt":47},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[149,150,153],{"categoryNo":119,"categoryName":120,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":151,"categoryName":152,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":154,"categoryName":155,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师",[157,158,9,46,159,160,161,162,163,164,134,165,166,167,168,169,170,139,142,171,27],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":184,"publishedAt":47},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[178,179,182,183],{"categoryNo":119,"categoryName":120,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":180,"categoryName":181,"taxonomyType":116,"taxonomyTypeDesc":117},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":151,"categoryName":152,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":154,"categoryName":155,"taxonomyType":21,"taxonomyTypeDesc":22},[185,186,187,188,46,189,190,191,192,193,194,195,196,27,197,198,199,134,200,135],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":207,"publishedAt":47},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[208,209,210,211,212,213,214,215,131,216,217,218,219,220,221,194,222,223,224,27,225,226,199,227],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":237,"publishedAt":47},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[234,235,236],{"categoryNo":119,"categoryName":120,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":151,"categoryName":152,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":154,"categoryName":155,"taxonomyType":21,"taxonomyTypeDesc":22},[9,238,239,240,241,171,242,243,244,245,246,161,247,248,249,195,38,250,27,251,198],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","database","candidate",{"skillNo":253,"name":254,"nameZh":6,"description":255,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":256,"categories":257,"keywords":260,"publishedAt":47},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[258,259],{"categoryNo":119,"categoryName":120,"taxonomyType":116,"taxonomyTypeDesc":117},{"categoryNo":151,"categoryName":152,"taxonomyType":116,"taxonomyTypeDesc":117},[261,44,138,25,9,188,262,46,189,263,264,265,266,27,267,198,134,268,269,270,271],"workload manager basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]