| name | add-grant |
| description | Add a GCP IAM or IAP user grant to the marin-iac Pulumi stacks, encrypting human principals. Use when someone needs access to a project role, bucket/secret/service account, or an IAP-gated web service (evaldash, grafana), whether requested locally or on a GitHub issue. |
Skill: Add a user grant
Turn an access request into a reviewable Pulumi change. Human principals in the
project-IAM data are KMS-encrypted; IAP viewers on Cloud Run services are
plaintext by design. The change is never applied here — a second person runs the
review-grant skill, merges, and runs pulumi up.
Read first:
infra/pulumi/README.md — the marin-iac stacks, the KMS key, and the
pulumi up prerequisites.infra/pulumi/src/iac/gcp/iam_data.yaml header — why human user: principals
are encrypted and this file is public.
Two grant surfaces
Decide which one the request needs before editing anything. A single request can
touch both.
-
Project / resource GCP IAM — a role on the hai-gcp-models project, the
KMS key, a Secret Manager secret, a GCS bucket, an Artifact Registry repo, or
a service account (who may impersonate it). Lives in
infra/pulumi/src/iac/gcp/iam_data.yaml, applied by the marin stack in
infra/pulumi. Each human user:<email> principal is KMS-encrypted once in
the principals registry; grants reference its opaque human-NNN ID.
Service accounts, groups, and domains stay plain strings.
-
IAP access to a Cloud Run web service — admitting a person to
evaldash.oa.dev, Grafana, or a similar IAP-gated site. Lives in that
service's under (a
plaintext list of emails, wildcards, or qualified IAM members),
applied by that service's own stack. and the Loom VM
are already admitted to every service; only add a entry for someone
outside the OpenAthena Workspace.
