5.2 Agent Identity, OAuth 2.0 & The 3-Layer Permission Wall

1. The 60-Second Anchor

Why do traditional AI agents fall for this trick? Because teams often make the mistake of giving an AI agent a single Shared GCP Service Account with broad access to every customer’s data!

To stop a “Confused Deputy” attack, Google Cloud enforces a 3-Layer Permission Wall plus User-Delegated OAuth 2.0:

SPIFFE Agent Identity: Instead of a generic service account, every deployed agent gets its own verifiable cryptographic passport (spiffe://...).
Wall 1 — Principal Access Boundary (PAB): Defines where that Agent Identity is eligible to go (e.g., it can only touch the Retail Banking folder, never the Wealth Management project).
Wall 2 — IAM Deny Policy: The explicit veto wall (e.g., no agent can ever delete audit logs, even if granted Owner).
Wall 3 — IAM Allow + OAuth 2.0 Auth Manager: For sensitive tools like wiring money, the agent cannot use its own identity—it must use Auth Manager to request an OAuth 2.0 token scoped strictly to the logged-in human customer.

2. Interactive Visual Matrix: The 3-Layer Permission Wall

Click any node or use the Next / Prev buttons and Mode Toggle below to see how VaultBank’s 3-Layer Permission Wall evaluates a legitimate transfer versus a cross-account heist:

3. High-Yield Exam Matrix: Which Control Sees What?

The #1 trap on the PAAC exam is picking an IAM or PAB policy to solve a problem that requires OAuth 2.0 or an ADK Callback. Memorize this boundary matrix:

Security Control	What It Controls	Can It See Tool Arguments (like `$50,000`)?	When to Pick It on the Exam
Principal Access Boundary (PAB)	Eligibility: Which GCP folders/projects the Agent Identity is allowed to touch.	No	You need a hard outer fence so an agent can never access resources outside its business unit, even if granted an IAM role by mistake.
IAM Allow & Deny Policies	Cloud Permissions: Which GCP APIs or MCP servers the agent can call.	No	You need least-privilege cloud resource access or an explicit Deny rule that overrides all Allow roles.
OAuth 2.0 (Auth Manager)	User Delegation: Executes a tool using the logged-in human’s permissions instead of the agent’s own permissions.	No (Scopes only)	An agent acts on behalf of a specific user (like reading their personal bank balance or Google Drive) to prevent Confused Deputy attacks.
ADK Before-Tool Callback	Runtime Payload Inspection: Checks the exact tool name and parameters (`amount=50000`) inside the agent code.	YES!	You need to block or trigger Human-in-the-Loop approval based on a specific parameter value (covered next in 5.3!).