谷歌近期正式发布 Data Agent Kit，结束了整个夏季的预览。它免费、开源，可以安装到非谷歌编码智能体中。它提供两种控制方式，这种差异在生产环境中至关重要。
Data Agent Kit 是一个 MCP 工具集，能够将智能体连接到超过十五项谷歌数据云服务，外加谷歌提供的技能，指导智能体完成 BigQuery SQL 优化、Bigtable 行键设计等实践。它运行在 Antigravity、Claude Code、Codex、Cursor 和兼容 VS Code 的编辑器中，并预装在 Cloud Shell 和 Cloud Workstations 中。
Data Agent Kit 部署在编码智能体与谷歌数据云服务之间，包含两个组件：承载最佳实践指引的技能集合，以及对外暴露实时元数据和工具的 MCP 服务器。（来源：谷歌官方博客）
随着正式版发布，谷歌新增支持 BigQuery Graph、Bigtable 和 Apache Spark 托管服务。产品经理 Arun Nair 与开发者布道师 Jeff Nelson 在发布博文中提到，它填补了智能体原生能力的一个空白：智能体虽然能写出不错的 SQL，但它不知道“有哪些表、表如何分区、哪些表是团队可信的，或是昨夜的任务为什么失败”。
插件仓库包含了 37 个技能，基于 Apache 2.0 协议，每个技能的元信息都标注谷歌为发布方。它有版本管理规范，9 月 29 日发布 1.0.0，10 月 13 日发布 1.1.0，团队可以锁定固定版本使用。
在这些技能中，accidental-data-loss-prevention 可以阻止智能体执行破坏性操作。它的描述以“STOP AND VERIFY”作为开头，告诉智能体在执行任何不可逆操作之前“必须获得用户的明确许可”，列出了 DROP TABLE、TRUNCATE、无 WHERE 子句或使用 1=1 的 DELETE、针对生产存储桶的存储删除、gcloud projects delete 以及 KMS 密钥销毁等。流程为：暂停操作、说明影响、等待用户确认。
这个防护属于引导性建议，依靠智能体自觉遵守，而第二类控制是强制性的。
在 LinkedIn 帖子 中被问及是否可以将只读查询与修改基础设施的工具隔离开时，Nelson 回答说这是在 IAM 中处理的，而不是在智能体层面单独处理：可以通过身份模拟让智能体以只读服务账号运行，或是使用“IAM 拒绝策略，拦截所有 tool.isReadOnly 为 false 的 MCP 工具”。
api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false
它拒绝 mcp.googleapis.com/tools.call 权限，可在组织、文件夹或项目级别生效。配套属性支持 resource.service 和 tool.name。
这有三个限制。被阻止的工具仍然出现在 tools/list 中，因此智能体能看到它无法使用的功能，只在调用时才知道。这些控制仅涵盖谷歌云 MCP 服务器，不包括其他。而且 resource.service 和 tool.name 仅在 gcloud 中可用，控制台中没有。
AI 解决方案架构师 Amel Habira 阅读文档后比较看好，他提到短期凭证、只读标记以及在智能体运行 Notebook 单元格前给出告警。他写道：
结合 Iceberg 的分支与时间旅行能力，你可以在访问层和数据层同时实现风险隔离。
viaSocket 的 AI 工程师 Ankit Dongre 将边界划得更远：
接入 MCP 只是比较简单的一环。生产环境的核心边界是权限范围加上可重试安全执行：当智能体超时后重试写入，或是运行中途表结构发生变更时会发生什么？
他补充说，IAM 和试运行涵盖了授权和预检，“但它们不会告诉智能体超时写入是否已提交。完善的返回结果应当包含幂等键、提交状态和可回滚性。”Data Agent Kit 的工具结果目前并不包含这些信息。
微软选择了另一种方案。处于公开预览阶段的 Agent 365 与 Azure API Management 的 MCP 治理集成将治理策略统一放在 Microsoft 365 管理后台，在网关层强制执行。按工具拦截功能需要预览套餐，应用程序密钥作用于网关级别，对所有模型和工具生效。谷歌基于客户已在使用的 IAM 体系进行工具鉴权，并传播用户身份，从而支持行级、列级安全策略。
自托管任务自动化厂商 Conductral 的创始人 Timon Knapp 写道：
把智能体接入 Airflow 实时环境，这种能力非常强大。根据多年运行生产批处理的经验，我会先只开放只读权限和建议能力，任何修改调度、重跑任务的操作都必须人工确认。清晰的审计日志能让后续给智能体扩容权限变得更加稳妥。
Data Agent Kit 除智能体使用的谷歌云服务外不收取任何费用。这些技能在 GitHub 上，可以 fork。
查看英文原文：https://www.infoq.com/news/2026/10/data-agent-kit-ga/
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Google has recently completed a full summer preview of publish Data Agent Kit. It is free and open and can be installed in non-Google code AI agent. It provides two modes of control, which are essential in the production environment.
Data Agent Kit is a MCP toolset that connects AI agent to more than 15 Google Data Clouds services, plus the skills provided by Google to guide AI agent in the completion of BigQuery SQL optimization, Bigtable line design, etc. It runs in Antigravity, Claude Code, Codex, Cursor and VS Code-compatible editors and pre-packaged in Claude Shell and Cloud Works.
Data Agent Kit is deployed between coding AI agent and Google Data Clouds, and contains two components: a skill set to carry best practice guidance and a MCP server to expose real-time metadata and tools externally. (Source: Google Official Blog)
With the official version of publish, Google has added support for BigQuery Graph, Bigtable and Apache Spark hosting services. The product manager, Arun Nair, and the developer preacher, Jeff Nelson, mentioned in publish Bo that it fills a gap in the original capacity of AI agent: while AI agent can write a good SQL, it does not know “what tables, how they are divided, what tables are credible for the team, or why the mission failed last night”.
The plugin warehouse contains 37 skills based on the Apache 2.0 protocol, each of which has meta-information marked Google as publish. It has a version management code, publish 1.0 on September 29, and publish 1.1.0 on October 13, where teams can lock on fixed versions.
Among these skills, accental-data-loss-prevention can prevent AI agent from performing destructive operations. Its description starts with “STOP AND VERIFY”, informing AI agent that “a clear user permit must be obtained” before performing any irreversible operation, listing DROP TABLE, TRUNCATE, DELETE without WHERE or using 1=1, storage deletions for production tanks, gcloud projects delete and KMS key destruction. Processes are: suspension, description of impact, waiting for user confirmation.
This protection is a guided recommendation and relies on AI agent ' s conscious compliance, while the second type of control is mandatory.
In LinkedIn, asked if it was possible to separate read-only queries from infrastructure modification tools, Nelson replied that this was handled in IAM, not at AI agent level alone: AI agent could be used to run a read-only service account using identity simulations, or to intercept all MCP tools that tool.is ReadOnly are false using “IAM rejection strategies”.
api.getAttribute('mcp.googleapis.com/tool.isReadOnly', false) == false
It rejects mcp.googleapis.com/tools.call permission, which can be effective at organizational, folder or project level. Accompanying properties supports access.service and tool.name.
There are three limitations. The prevented tool still appears in the tables/list, so AI agent can see the functionality it cannot use, only when called. These controls only cover Google Cloud MCP servers, not others. Also, access.service and tool.name are only available in gcloud and not on the console.
AI Solutions Architect Amel Habira, who looks better after reading the document, refers to short-term vouchers, read-only tags and warnings before AI agent runs Notebook cells. He writes:
Combined with Iceberg's branch and time travel ability, you can isolate risks at both the access and data levels.
Ankit Dongre, an AI engineer from viaSocket, cuts the border even further:
Access to MCP is just a simple link. The core boundary of the production environment is the scope of permission plus safe execution of retry: What happens when retry is written after AI agenttimeout or when there is a change in the structure of the running stopwatch?
He added that IAM and the pilot operation covered authorization and pre-screening, “but they would not tell AI agenttimeout whether it had been submitted. A perfect return result should include the same key, submission status and rollability. The Data Age Kit tool results do not currently contain this information.
Microsoft chose another option. Agent 365, in the public preview phase, and the MCP governance integration of Azure API Management, have integrated the governance strategy into Microsoft 365 management backstage and are enforced at the gateway level. The interception function by tool requires a preview of the package and the application key functions at the gateway level and is effective for all models and tools. Google supports line and line security strategies by using the IAM system, which is already in use by clients, for tool recognition and dissemination of user identities.
Timon Knapp, founder of the hosting mission automation manufacturer Conductral, writes:
The ability to connect AI agent to AirFlow's real-time environment is very powerful. Based on the experience of running production batches over the years, I will first open only permission and recommend capability, and any modification of scheduling and rerun operations will require human confirmation. A clear audit log would make subsequent expansion of AI agent permission more secure.
Data Agent Kit does not charge any fees except for Google Cloud services used by AI agent. These skills are on GitHub and can be fork.
See the English original language at https://www.infoq.com/news/2026/10/data-ent-kit-ga/
Auto-fetched and translated by AI Atlas. All rights belong to the original author.