Letting AI Agents Use the Google Cloud CLI Safely — Drop the Keys, Lock It Down with Impersonation and a Command Broker

Hand an AI agent a shell and Google Cloud credentials at the same time, and a single prompt injection can turn into a misfired gcloud command that escalates privileges or exfiltrates data. Short-lived credentials and least privilege, which is Google's official guidance, are the right direction. But service account keys persist dangerously when leaked, and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM, organization policy, and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a single input never reaches production.