Agent report card
Can an agent use Google Cloud through API resource management?
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upReady
- PayReady
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
The Cloud Resource Manager API reference documents the base service endpoint (https://cloudresourcemanager.googleapis.com) and exact REST resource routes.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Verified structured artifacts accelerate discovery of the evaluation surface.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
Google Cloud explicitly defines the eligibility conditions for the Free Trial, stating that a user is eligible when they have never been a paying user of Google Cloud, Google Maps Platform, or Firebase, and haven't previously signed up for the Free Trial.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
Resource Manager pricing explicitly states that all use of the Cloud Resource Manager API and Cloud Asset API are free of charge, while specifying exact pricing conditions and dollar rates when using tags with Cloud Storage.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The Cloud Resource Manager API reference documents the base service endpoint (https://cloudresourcemanager.googleapis.com) and exact REST resource routes.
Are verified structured discovery artifacts available?
supported: freshVerified structured artifacts accelerate discovery of the evaluation surface.
Google APIs Discovery Service provides machine-readable JSON schema metadata (JSON Schema draft-03) for API operations, resources, and methods. The Cloud Resource Manager API reference explicitly lists discovery document URLs for its API versions.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
Google Cloud Service Specific Terms are publicly accessible, stable, and retrievable, covering additional terms specific to Google Cloud services and offerings.
Does the vendor deliberately describe access for web agents?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence from the evaluated documentation resources does not establish an explicit web-agent or crawler access policy such as a robots.txt declaration.
A stable canonical route begins the required access bootstrap.
The retained evidence provides a canonical entrypoint to begin obtaining service access via the 'Get started for free' route on the Google Cloud free page.
Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence shows 'Get started for free' marketing buttons on the Google Cloud page, but does not contain detailed form fields, validation controls, or handoff mechanisms to confirm deterministic access-control operability.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
The retained evidence provides a canonical entrypoint to begin obtaining service access via the 'Get started for free' route on the Google Cloud free page.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained pages do not contain explicit declarations or direct observations establishing the presence or absence of a mandatory CAPTCHA challenge in the signup flow.
Can an agent obtain scoped, revocable authority for this service?
supported: freshScoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.
Google Cloud documentation explicitly declares support for scoped, revocable credentials, including short-lived OAuth 2.0 access tokens, service account impersonation, and Workload Identity Federation.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence does not contain information regarding phone verification requirements or supported handoff boundaries during account setup.
Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
Google Cloud Resource Manager pricing documentation explicitly discloses that use of the Cloud Resource Manager API and Cloud Asset API is free of charge, while detailing exact monthly rates in USD ($0.005 per month) and operation class charges for bucket tags.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
Retained evidence describes Cloud Billing API resources and payment methods like credit cards and bank accounts, but does not document a deterministic flow for an agent to construct checkout, hand off approval safely, and resume.
Is the exact commercial commitment disclosed before authorization?
supported: freshCharge or no-charge status, currency, recurrence, and material conditions are disclosed.
Google Cloud Resource Manager pricing documentation explicitly discloses that use of the Cloud Resource Manager API and Cloud Asset API is free of charge, while detailing exact monthly rates in USD ($0.005 per month) and operation class charges for bucket tags.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
Retained documentation describes adding primary and backup payment methods (credit/debit cards and bank accounts) and mentions zero-dollar authorization requests, but does not document an explicit scoped delegation rail or human-confirmed authorization flow with receipts.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
Documentation provides a direct self-service path to create and manage online, self-serve Cloud Billing accounts using credit cards, debit cards, or bank accounts to pay for Google Cloud usage without a required vendor decision point.
Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Resource Manager operations.get endpoint permits polling long-running operations at intervals to retrieve their latest state via GET requests, but current evidence leaves specific terminal failure reconciliation and time bounds unstated.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Credentials, grants, or configuration are delivered through a documented agent-usable flow.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshCredentials, grants, or configuration are delivered through a documented agent-usable flow.
Documented REST authentication flows allow acquiring access tokens programmatically through user CLI credentials, Application Default Credentials, service account impersonation using the IAM serviceAccounts.getAccessToken permission, or the metadata server via HTTP GET requests.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshCompletion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Resource Manager operations.get endpoint permits polling long-running operations at intervals to retrieve their latest state via GET requests, but current evidence leaves specific terminal failure reconciliation and time bounds unstated.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Project creation can be initiated programmatically via POST requests to the Resource Manager REST API (projects.create), returning a long-running Operation resource to track the creation process.
What would improve this stage
- Expose bounded machine-readable terminal status and reconciliation semantics.
Safe failure handling is documented only partially.
Documentation establishes HTTP status codes, error messages (such as rate limits and quota limits), and operation polling via operations.get, but does not establish cancellation or full reconciliation semantics.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Google Cloud; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.
- cloud-billing
- resource-manager
- workload-authentication
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Documentation establishes service account key creation, deletion, rotation, disabling, enabling, and short-lived access token generation, but leaves recovery and compromise handling partially constrained.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
Documentation establishes HTTP status codes, error messages (such as rate limits and quota limits), and operation polling via operations.get, but does not establish cancellation or full reconciliation semantics.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Request-time authentication with scoped authority is documented using OAuth 2.0 Bearer tokens, short-lived federated access tokens, Application Default Credentials, and service account impersonation.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
Essential operation inputs, outputs, schemas, HTTP methods, endpoints, parameters, and long-running operation polling responses are explicitly documented and decidable across all assessment targets.
- cloud-billing
- resource-manager
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Every essential target is accessible through documented machine-operable interfaces including REST APIs, client libraries, and gcloud CLI tools.
- cloud-billing
- resource-manager
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
- Sign up: A stable canonical route begins the required access bootstrap.
- Pay: Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
What blocks agents
No stage is established as blocked.
Where autonomy is limited
- Provision: Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
- Operate: Safe failure handling is documented only partially.
What this grade establishes
14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.
How the grade is derived
A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.
Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.
Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.
Startup offers
Google Cloud on the startup-offers board
- Year 1 — 100% up to $100,000 in Google Cloud creditsGoogle Cloud Scale tier
- Up to $2,000 in Google Cloud credits for one yearGoogle Cloud Start tier
- Year 1 — 100% up to $250,000 in Google Cloud credits for AI-first startupsAI startups
Distribution
The grade’s badge
One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.
[](https://sourcey.com/log/google-cloud/agent-readiness/google-cloud/api-resource-management)Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzez1s4a8w7a28x0v333trbt
- Projection
- sha256:804b415f88a3c81d80635208ecc38907aa0f14e81439cbb07b4f3423840b1f01
- Policy
- service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration