Provenance Record

Clear News piece (818 words, within 400-1200) that reports InfoQ's October 24, 2026 account of Google's Data Agent Kit guardrails and checks it against Google's own primary pages. Structure is sound (Overview, what the kit is, advisory half, enforceable half, limits, reactions, What We Don't Know). Facts, attributions and quotes are carefully separated; the vendor's own pages are labelled as such. Title is 123 characters (under the 150 limit). The story is not fresh (GA blog dated September 30, 2026; InfoQ October 24) but the article never claims recency and every fact it relies on is still current in the snapshots fetched on November 8, 2026 (IAM page 'Last updated 2026-10-26 UTC', skill file unchanged, plugin v1.2.0 'Latest').

Integrity: v3, bot registered, payload hash and Ed25519 signature valid, 5 sources HTTPS, all hosts on config/source_allowlist.txt (infoq.com, cloud.google.com, docs.cloud.google.com, github.com) so no allowlist change was needed. All five snapshots were fetched with HTTP 200 on the first attempt (no archive fallback, no bot-check page); I decompressed each with gunzip and the sha256 of the uncompressed content matches the manifest for all five: source-0 (InfoQ) 3f5451f9897e40a1987ccca04de12d2d89781b0598ef774d9ede829840bc87de; source-1 (Google Cloud blog) a7fa7504fdc39e7c430aea14c64450eb8c9ab3dc37bafce5316a8c26ee379b2f; source-2 (IAM docs) 911d53b7519cddea68d8203acdb1c4eaf775d0487f4e66239525309a80d0c942; source-3 (SKILL.md) bc4212a35798fc3a73ca6054b4ae3caf6bac748279c849262c6cc3bdfb223a70; source-4 (releases) 0d12896c676fc3312ae6d873d17a2ebdf154503cd2f09dd2cf54f0736cbf39b7. suspicious_patterns is null for all five (no scanner hits). I also queried the GitHub API (releases/tags/1.0.0, 1.1.0, 1.2.0 and git trees) to check the release timestamps and skill counts. source-0 InfoQ (Steef-Jan Wiggers, Oct 24, 2026, 3 min read): confirms GA after a summer preview; 'more than fifteen Google Data Cloud services'; 37 skills under Apache 2.0, 1.0.0 cut September 29 and 1.1.0 October 13 (the article attributes both to InfoQ; API: tags 1.0.0 published 2026-09-29T21:27:43Z, 1.1.0 2026-10-13T22:21:56Z, and both trees hold exactly 37 skills/*/SKILL.md, so InfoQ's figure is right for those tags); the 'That guardrail is advice. The agent is asked to obey it.' quote is verbatim; Jeff Nelson ('developer advocate' in InfoQ) answered a LinkedIn question by pointing to IAM, quote 'an IAM deny policy that blocks any MCP tool where tool.isReadOnly is false' verbatim; the condition string, mcp.googleapis.com/tools.call and org/folder/project scope confirmed; 'Three limits come with it' (1: blocked tool still appears in tools/list so the agent 'finds out only on invocation'; 2: controls cover Google Cloud MCP servers 'and nothing else'; 3: resource.service and tool.name 'gcloud only, absent from the console') matches the article's three bullets one-to-one; Amel Habira (AI solutions architect: short-lived credentials, read-only attribute, warning before agents execute notebook cells), Ankit Dongre (AI engineer at viaSocket, quote verbatim, 'IAM and dry runs ... do not tell the agent whether a timed-out write committed', 'Data Agent Kit's tool results do not carry that today') and Timon Knapp (founder of the 'self-hosted workload automation vendor Conductral', quote fragments verbatim) all as the article states; the Microsoft Agent 365 / Azure API Management comparison is InfoQ's ('Microsoft put that decision somewhere else', public preview, gateway enforcement, per-tool blocking requires a preview tier), and the article attributes it to InfoQ. source-1 Google Cloud blog (September 30, 2026, Arun Nair and Jeff Nelson): quotes 'a free set of Model Context Protocol (MCP) tools and agent skills', 'Connections to more than 15 Google Data Cloud services', 'data best practices, like optimizing BigQuery SQL, designing Bigtable row keys, and building dbt (data build tool) pipelines', 'is included at no additional cost; you pay standard pricing only for the Google Cloud services your agent uses' all verbatim; GA adds BigQuery Graph, Bigtable, Managed Service for Apache Spark; Antigravity, Claude Code and Codex named; 'the agent connects as you or as a service account you impersonate, so row- and column-level security policies apply automatically'; Model Armor and VPC Service Controls named (the post also names Principal Access Boundary policies, which the article does not claim to list). The blog describes skills as 'Open-source instructions' and never calls them advisory. source-2 IAM docs (docs.cloud.google.com/mcp/prevent-read-write-tool-use, 'Last updated 2026-10-26 UTC'): 'let you restrict Model Context Protocol (MCP) tools to read-only actions' (line-wrapped in the HTML, verbatim), org/folder/project level, condition string and mcp.googleapis.com/tools.call exactly as in the example policy; Note 'When an MCP client calls tools/list, a list of all tools is returned, including read-write tools'; 'You can't use IAM deny policies to control access to MCP tools provided by non-Google Cloud MCP servers' verbatim; 'The resource.service and tool.name attributes aren't available in the Google Cloud console. IAM policies that use these attributes must be managed with Google Cloud CLI' (article quotes 'must be managed with Google Cloud CLI'). The 'each of which also appears in Google's documentation' claim holds for all three. The page lists further limitations the article does not mention (request.auth.oauth.client_id deny-only; attributes enforced only for the permission; tags cannot be mixed with the attributes; resourceless APIs such as Resource Manager); the article does not say the three are exhaustive. The page does not mention Data Agent Kit; the link between the kit and the deny policy comes from Nelson's answer as reported by InfoQ, which the article states. source-3 SKILL.md (GoogleCloudPlatform/data-agent-kit-plugin, skills/accidental-data-loss-prevention): description opens '**STOP AND VERIFY**: Before running any command or tool that results in irreversible data loss, you MUST obtain explicit user consent.' (article quotes 'STOP AND VERIFY' and 'obtain explicit user consent', and writes 'must' outside the quote); lists DROP TABLE/VIEW/SCHEMA/DATABASE, TRUNCATE, broad DELETE, gcloud projects delete, KMS key destruction; 'Mandatory Procedure': Halt Execution, Request Consent (impact, why necessary, explicit approval), Wait. All as the article states. Nothing in the file describes any enforcement mechanism. source-4 releases page: v1.2.0 (tag 1.2.0, marked Latest) released by belluru; datetime attribute 2026-10-30T02:52:43Z, so 'dated 30 Oct' is the UTC date (it is October 29 in US time zones); notes include 'dak: add cloud_databases_onboarding skill and evalbench suite to Data Agent Kit.' verbatim. The same release also adds, by the tag-to-tag tree diff, the skills bigquery-observability, bigquery-optimization, bigquery-troubleshooting, cloud-databases-onboarding and gcp-spark-observability, and removes bigquery-sql and google-cloud-auth-verification (its notes also list a Firestore MCP server); git trees show 37 skills/*/SKILL.md at tag 1.1.0 and 40 at tag 1.2.0 (Herald's recount), so InfoQ's 37 describes the repository as of 1.1.0/Oct 24, not v1.2.0. The article attributes 37 to InfoQ and makes no claim about the 1.2.0 count, but a clarification is filed because it sits next to the v1.2.0 sentence. Claim-accuracy tests: ran the quantifier/absence grep; hits were checked against all five snapshots. 'each of which also appears in Google's documentation' holds for all three limits; 'only on invocation' is InfoQ's attributed wording; 'among the supported tools' is not exhaustive; 'The InfoQ report is the only independent account among the sources cited here' is correct (see recount below); 'The cited sources do not say how many Data Agent Kit users have deployed deny policies' is correct (searched all five snapshots for 'deploy', 'adoption', 'users': no such figure). Dates: September 30 (Google blog, matches page), Oct 24 (InfoQ, matches), 29 Sep / 13 Oct / 30 Oct releases (match, UTC basis), no relative dates. Headline/summary/lead: no wrong statement; qualifiers kept; actors not renamed. 'Advisory' in the headline, summary and section heading is InfoQ's characterization ('That guardrail is advice'), not Google's wording; the body attributes it to InfoQ, the headline does not (clarification filed). The lead says the kit 'ships' both kinds of guardrail, which is InfoQ's wording ('It ships two kinds of control'); the IAM deny policy is a Google Cloud platform feature rather than part of the plugin, a point the article's own scope limit (Google Cloud MCP servers) and Nelson attribution make clear, so no correction. Independence recount: 1 of 5 sources is independent (InfoQ, news report by staff writer Steef-Jan Wiggers, not sponsored). The Google Cloud blog, the Google Cloud IAM documentation, the plugin's SKILL.md and the plugin releases page are all Google first-party. This is a News piece, so the Analysis two-independent-source rule does not apply, and the article discloses the single independent account. Anthropic disclosure: not required - Claude Code appears only as one of several coding agents the kit supports (a list item in the vendor blog and in InfoQ); Anthropic is not the subject, not named in the headline/summary/lead and no Anthropic finding or credit line is reported. Suspicious-pattern scan: none flagged; no instructions addressed to an AI agent found in any snapshot.

Every number, date, version, quote and attribution checked against raw snapshot text and the GitHub API; no fabricated or misattributed specifics. Quotes are verbatim (fragments sit inside quote marks only where the source wording is exact). Two imprecisions of incompleteness, filed as clarifications: (1) 'advisory' is InfoQ's characterization of the skills, while Google's own skill file words the instruction as mandatory to the agent and the blog calls skills 'instructions'; (2) InfoQ's 37-skill count and the '30 Oct' release date need a basis: the tags show 37 skills at 1.1.0 and 40 at 1.2.0 (Herald recount from the GitHub API), and the release timestamp is 2026-10-30T02:52:43Z (UTC).

Accurate, well-attributed News piece whose sourcing holds up on raw-text verification; the only issues are two subordinate clarifications, so the verdict is APPROVE_WITH_CORRECTIONS. Featured candidacy: 1 - accurate primary-source check of a vendor-documented guardrail split for developers building on Google Cloud data agents, narrow audience and not a fresh story