[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M698ZH7R0NGT8S13GE47947Q":3,"skill-same:01M698ZH7R0NGT8S13GE47947Q":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M698ZH7R0NGT8S13GE47947Q","assuredworkloads-environment-assessor",null,"Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against sovereign data boundary and compliance standards (EU Data Boundary with Support, FedRAMP Moderate\u002FHigh, DoD IL4\u002FIL5, ITAR, CJIS, US\u002FEU Regional Data Boundaries), and recommend the optimal Assured Workloads Framework. Use when asked to: \"assess my environment for compliance\", \"which Assured Workloads framework should I use?\", \"check if my folder is ready for EU sovereignty\", \"evaluate compliance posture for folders\u002F123 or projects\u002Fxyz\", or \"discover compliance gaps before deployment\". Do NOT use for live mutating policy deployments, generating deep audit reports via Cloud Audit Manager, generating remediation scripts, or authoring custom Assured Workloads frameworks.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24235,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,9,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"assuredworkloads environment assessor","assessor","environment","when","recommend","which","org","scripts","authoring","live","discover","deep","brownfield","reports","ready","projects","fedramp","remediation","data","audit","framework","support","google cloud","2026-11-10 10:12:30",false,"---\nname: assuredworkloads-environment-assessor\nmetadata:\n  version: \"1.0.2\"\n  category: SecurityAndCompliance\ndescription: >-\n  Discover Google Cloud resource telemetry and effective Org Policies, evaluate brownfield workloads against\n  sovereign data boundary and compliance standards (EU Data Boundary with Support, FedRAMP Moderate\u002FHigh, DoD IL4\u002FIL5,\n  ITAR, CJIS, US\u002FEU Regional Data Boundaries), and recommend the optimal Assured Workloads Framework. Use\n  when asked to: \"assess my environment for compliance\", \"which Assured Workloads framework\n  should I use?\", \"check if my folder is ready for EU sovereignty\", \"evaluate compliance\n  posture for folders\u002F123 or projects\u002Fxyz\", or \"discover compliance gaps before deployment\".\n  Do NOT use for live mutating policy deployments, generating deep audit reports via Cloud Audit Manager,\n  generating remediation scripts, or authoring custom Assured Workloads frameworks.\n---\n\n# Compliance Environment Assessor Skill\n\nThis skill performs zero-risk, non-mutating compliance discovery, physical telemetry profiling, and data boundary framework recommendation across Google Cloud Folders (`folders\u002F{folder_id}`) and Projects (`projects\u002F{project_id}`).\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Safety & Execution Tier (CRITICAL)\n\n* **Tier R (Strictly Read-Only)**:\n  All discovery operations execute read-only queries\n  (`gcloud asset search-all-resources`,\n  `gcloud compliance-manager frameworks list`,\n  `gcloud compliance-manager cloud-controls describe`, and\n  `gcloud org-policies describe --effective`).\n  You MUST NEVER execute mutating commands (`gcloud compliance-manager framework-deployments create`,\n  `gcloud org-policies set-policy`, or `gcloud resource-manager ...`).\n\n---\n\n## Grounding Guardrails: Google Cloud & Assured Workloads Precedence (CRITICAL)\n\nTo prevent hallucinations, incorrect compliance assessments, and false blockers derived from generic LLM pre-training, the agent is governed by strict **Grounding Guardrails**:\n\n1. **Strict Prohibition on Generic LLM Pre-Training Priors**:\n   * You MUST NOT derive compliance rules, API semantics, or deployment constraints from generic web pre-training (e.g., generic NIST\u002FFedRAMP certification audit checklists, AWS\u002FAzure architectures, or legacy on-prem IT auditor mindsets).\n   * In traditional IT audits, non-compliance is a binary go\u002Fno-go gate that\n     blocks deployment. In Google Cloud Assured Workloads, deploying in\n     **Monitoring (`Detective`) mode** enables detective controls without\n     mutating existing Organization Policies, allowing continuous observability\n     without halting Day 0 rollout. You MUST NOT confuse these paradigms.\n2. **Authoritative Assured Workloads Scope & Deployment Grounding**:\n   * Assured Workloads binds compliance frameworks directly to existing or new\n     Google Cloud folders (`folders\u002F...`) and projects (`projects\u002F...`).\n   * **Existing Workloads (Folders or Projects)**: Recommend deploying in\n     **Monitoring (`Detective`) mode** first to assess and remediate findings\n     safely without mutating existing Organization Policies, and then\n     transitioning to **Preventive** mode.\n   * **New Workloads (Folders or Projects)**: Recommend starting in\n     **Preventive** mode or **Monitoring (`Detective`) mode**.\n   * **Google Cloud Console Deployment**: Always guide the user to deploy the\n     recommended framework via the **Assured Workloads Frameworks tab in Google\n     Cloud Console**\n     (`https:\u002F\u002Fconsole.cloud.google.com\u002Fcompliance\u002Fconfigure\u002Fframeworks?organizationId=ORGANIZATION_ID`).\n     Do NOT recommend `gcloud assured workloads create` (which only provisions\n     new greenfield folders using legacy regime enums and cannot bind frameworks\n     to existing folders or projects).\n3. **Client-Side Org Policy Readiness vs. Server-Side CES Boundary**:\n   * **Client-Side Scope**: Pre-flight evaluation via\n     `scripts\u002Fevaluate_control_rules.py` assesses **ONLY the 3 high-confidence\n     Organization Policy parameter sets** bound in\n     `Framework.cloudControlDetails[].parameters`:\n     1. Resource Locations (`builtin-restrict-resource-locations` \u002F\n        `constraints\u002Fgcp.resourceLocations`)\n     2. Service Usage Restrictions \u002F SUR\n        (`builtin-enforce-service-usage-restrictions` \u002F\n        `constraints\u002Fgcp.restrictServiceUsage`)\n     3. CMEK Encryption Requirements (`builtin-require-cmek` \u002F\n        `constraints\u002Fgcp.restrictNonCmekServices`)\n   * **Server-Side CES Scope**: Complex Continuous Evaluation Service\n     (`ces_rule`) and REST API rules (`rest_api_measurement`) are evaluated\n     **server-side by the Continuous Evaluation Service (CES)** after the\n     framework is deployed.\n   * **Terminology Invariant**: You MUST frame client-side findings as\n     **Pre-Flight Org Policy Readiness Recommendations \u002F Potential Drift\n     Indicators** (`orgPolicyDriftIndicators`), NEVER as definitive compliance\n     \"violations\" or \"deployment blockers\" that could contradict an actual\n     post-deployment CES run.\n4. **Static Built-In Catalog, Session Caching, Support Routing & KAJ Flow**:\n   * Built-in Frameworks (`type: BUILT_IN`) returned by\n     `gcloud compliance-manager frameworks list` are static configurations\n     uniform across organizations. Fetch `frameworks.json` once per session and\n     reuse the cached file across all candidate evaluations and follow-up\n     queries.\n   * **Personnel Support Model**: Determine whether a framework requires a\n     **Paid Sovereign\u002FRegulated Support Subscription** or uses **Standard\n     Commercial Support** ($0 support uplift) from the framework's public\n     `displayName` and `description` in `frameworks.json`:\n     - **Paid Sovereign\u002FRegulated Support Subscription**: Frameworks whose\n       `description` specifies support personnel access controls (e.g.,\n       `\"Support access controls are set to ...\"`, `-and-support` variants\n       such as `builtin-eu-data-boundary-and-support` and\n       `builtin-us-data-boundary-and-support`, or regulated standards such as\n       `builtin-il4`, `builtin-il5`, `builtin-itar`, `builtin-fedramp-high`,\n       `builtin-cjis`).\n     - **Standard Commercial Support ($0 support uplift)**: Regional-only Data\n       Boundary frameworks whose `description` sets data location controls only\n       without a support access controls clause (e.g.,\n       `builtin-us-data-boundary`, `builtin-eu-data-boundary`,\n       `builtin-uk-data-boundary`, `builtin-japan-data-boundary`).\n     - **Important**: Do NOT use the mere presence of\n       `builtin-restrict-technical-support-services` in `cloudControlDetails`\n       as a discriminator, because both regional-only and paid-support Data\n       Boundary frameworks include that control.\n   * **Key Access Justifications (KAJ) & EKM**: Recommend\n     `-with-access-justifications` framework variants only when the customer\n     **explicitly requests KAJ\u002FEKM**, or when disambiguating between matching\n     regional variants in `frameworks.json`.\n5. **Deterministic Tool Gating**:\n   * You MUST NOT guess compatibility scores ($$S_{\\text{composite}}$$) or resource inventories.\n   * You MUST execute `scripts\u002Fevaluate_control_rules.py` with `--frameworks-file=frameworks.json`.\n\n## Prerequisites\n\nBefore executing environment assessment, ensure your local or Cloud Shell environment meets the following prerequisites:\n\n1. **Google Cloud SDK**:\n   * Install and initialize the latest Google Cloud CLI (`gcloud`): https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall.md.txt\n2. **Project Setup & Target Selection**:\n   * Select or configure an administrative project for running assessment queries:\n     ```bash\n     gcloud config set project PROJECT_ID\n     ```\n3. **Region Configuration & Availability**:\n   * Configure a well-supported default region (e.g. `us-central1`):\n     ```bash\n     gcloud config set compute\u002Fregion us-central1\n     ```\n   * Consult official region availability documentation: [Google Cloud Locations](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations).\n4. **Required API Enablement**:\n   * Enable the required Google Cloud APIs on the administrative project:\n     ```bash\n     gcloud services enable \\\n       cloudasset.googleapis.com \\\n       orgpolicy.googleapis.com \\\n       assuredworkloads.googleapis.com \\\n       cloudsecuritycompliance.googleapis.com\n     ```\n5. **Authentication Setup**:\n   * Authenticate your user or service account identity and establish application default credentials:\n     ```bash\n     gcloud auth login\n     gcloud auth application-default login\n     ```\n6. **Billing & Quota Project Setup (Zero Billing Impact)**:\n   * **Zero-Cost Assessment Guarantee**: Running this assessment incurs **$0 in\n     Google Cloud infrastructure and API billing charges**. All discovery\n     operations (`gcloud asset search-all-resources`,\n     `gcloud compliance-manager frameworks list`, and\n     `gcloud org-policies describe --effective`) are free read-only metadata\n     queries.\n   * **Quota Project Requirement**: Google Cloud Service Infrastructure requires an administrative project with an active Cloud Billing account attached to allocate API rate limits and meter service usage (sent via the `X-Goog-User-Project` header), even for free APIs.\n   * **Pre-Flight Verification**:\n     ```bash\n     # 1. Verify active Cloud Billing account is attached to administrative project\n     gcloud billing projects describe PROJECT_ID --format=\"value(billingEnabled)\"\n\n     # 2. If using a shared project, ensure your user identity has permission to consume project quota\n     gcloud projects add-iam-policy-binding PROJECT_ID \\\n       --member=\"user:USER_EMAIL\" \\\n       --role=\"roles\u002Fserviceusage.serviceUsageConsumer\"\n\n     # 3. Synchronize Application Default Credentials quota project\n     gcloud auth application-default set-quota-project PROJECT_ID\n     ```\n7. **Commands & Payloads Reference**:\n   * Consult the [Google Cloud CLI Commands Reference](references\u002Fgcloud-commands.md) for full server-side projection masks, field filters, and API payload definitions.\n\n---\n\n## Step-by-Step Operating Workflow\n\n### Step 1: Ingest Scope & Resolve Organization ID\n\n1. Accept or prompt for the target scope (`folders\u002F{folder_id}` or `projects\u002F{project_id}`). If the user provides an open-ended scope without stating a regulatory regime, DO NOT block on broad questionnaires. Proceed immediately to ingest telemetry.\n2. Automatically resolve the parent Organization ID from the scope to drive downstream catalog queries:\n   * **For Folders**:\n     ```bash\n     gcloud resource-manager folders describe FOLDER_ID --format=\"value(parent)\"\n     ```\n     *(If the parent is another folder, traverse up ancestors until `organizations\u002F{org_id}` is found)*\n   * **For Projects**:\n     ```bash\n     gcloud projects get-ancestors PROJECT_ID --format=\"value(id,type)\"\n     ```\n\n### Step 2: Ingest Asset Telemetry & Effective Org Policies via Two-Pass Telescoping Protocol\n\nTo guarantee 100% coverage across the scope hierarchy while keeping payloads compact, telemetry ingestion executes in two telescoping passes (see [Google Cloud CLI Commands Reference](references\u002Fgcloud-commands.md)):\n\n1. **Pass 1: Macro Footprint & API Enumeration (100% Scope Coverage)**:\n   ```bash\n   gcloud asset search-all-resources \\\n     --scope=\"folders\u002FFOLDER_ID\" \\\n     --page-size=500 \\\n     --format=\"json(name,assetType,location)\" > macro_telemetry.json\n   ```\n   * *Pagination & Scope Semantics*: `--page-size=500` fetches 500 cloud assets\n     per HTTP API page (the maximum batch size permitted by Cloud Asset\n     Inventory), automatically paginating through all assets strictly inside\n     `folders\u002FFOLDER_ID` and its descendant projects.\n   * *Full Location & SUR Coverage*: `macro_telemetry.json` captures 100% of\n     active `location` and `assetType` values required to evaluate both\n     `builtin-restrict-resource-locations` (`allowedLocations`) and\n     `builtin-enforce-service-usage-restrictions` (`allowedServices` \u002F SUR).\n   * If `PERMISSION_DENIED` is returned:\n     - If the error states `USER_PROJECT_DENIED` or references `roles\u002Fserviceusage.serviceUsageConsumer`, the error is on the **administrative quota project** (it lacks an attached billing account or caller lacks `serviceUsageConsumer`). Follow the Quota Project Recovery playbook and stop running further commands.\n     - If the error references the target scope (`folders\u002F...` or `projects\u002F...`), HALT ALL TOOL CALLS IMMEDIATELY (do not run Step 2.2, Step 3, or any further commands) and inform the user they require `roles\u002Fcloudasset.viewer` and `roles\u002Forgpolicy.policyViewer` on that scope.\n   * If 0 resources are returned, inform the user the target scope is empty.\n\n2. **Inspect Effective Universal Org Policies on Scope (`38\u002F38` Frameworks)**:\n   ```bash\n   gcloud org-policies describe gcp.resourceLocations \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_locations.json\n\n   gcloud org-policies describe gcp.restrictServiceUsage \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_services.json\n\n   gcloud org-policies describe gcp.restrictTLSVersion \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_tls.json\n   ```\n\n### Step 3: Fetch & Cache Built-In Framework Catalog and Filter by Location + SUR\n\n1. **Fetch & Cache Built-In Framework Catalog (with Bound Parameters)**:\n   ```bash\n   if [ ! -s frameworks.json ]; then\n     gcloud compliance-manager frameworks list \\\n       --organization=ORGANIZATION_ID \\\n       --location=global \\\n       --filter=\"category:ASSURED_WORKLOADS\" \\\n       --format=\"json(name,majorRevisionId,displayName,description,category,cloudControlDetails)\" > frameworks.json\n   fi\n   ```\n   * *Session Caching*: Because built-in `ASSURED_WORKLOADS` frameworks are\n     static definitions uniform across organizations, cache the output in\n     `frameworks.json` and reuse it for all candidate evaluations and follow-up\n     questions.\n2. **Filter Candidates by Location + SUR Footprint & Clarify Intent**:\n   * Exclude location-less control-plane management metadata\n     (`cloudresourcemanager.googleapis.com\u002F*`, `orgpolicy.googleapis.com\u002F*`,\n     `cloudasset.googleapis.com\u002F*`, `accesscontextmanager.googleapis.com\u002F*`, and\n     `location: \"global\"` hierarchy nodes) from data-plane location checks.\n   * Match active data-plane regions (`location`) and active service prefixes\n     (`assetType`) from `macro_telemetry.json` against each framework's\n     `builtin-restrict-resource-locations` (`allowedLocations`) and\n     `builtin-enforce-service-usage-restrictions` (`allowedServices` \u002F SUR)\n     parameters in `frameworks.json`:\n     * **US-Only Regions (`us-central1`, `us-east4`)**: Candidates include DoD\n       IL5 (`builtin-il5`, adjudicated support), ITAR (`builtin-itar`, US\n       persons support), FedRAMP High\u002FModerate, or US Regional Data Boundary\n       (`builtin-us-data-boundary`, standard commercial support).\n     * **EU-Only Regions (`europe-west3`, `europe-west1`)**: Candidates include\n       EU Data Boundary and Support (`builtin-eu-data-boundary-and-support`) vs.\n       standard EU Regional Boundary (`builtin-eu-data-boundary`).\n   * **Targeted Disambiguation**:\n     * If multiple frameworks match the physical footprint and user regulatory\n       intent is unstated (e.g., an open-ended request with no regime specified),\n       DO NOT finalize a single primary recommendation yet — present the matching\n       candidate frameworks and STOP to ask the user a targeted clarifying\n       question about their regulatory intent (e.g., EU Sovereignty, US\n       FedRAMP\u002FIL5) and personnel support model (Standard Commercial Support vs.\n       Paid Sovereign\u002FRegulated Support).\n     * Recommend `-with-access-justifications` (KAJ\u002FEKM) framework variants only\n       if the customer explicitly asks for KAJ\u002FEKM or when disambiguating\n       between matching regional variants.\n     * **Out-of-Scope \u002F Non-Catalog Compliance Standards (e.g., CMMC, UK\n       GDPR)**:\n       If the user asks to evaluate a compliance standard or legal certification\n       that is not present as a built-in `ASSURED_WORKLOADS` framework in\n       `frameworks.json` (such as CMMC, UK GDPR, SOC 2, or PCI-DSS), DO NOT\n       fabricate or pass non-existent framework IDs (e.g., `builtin-cmmc` or\n       `builtin-uk-gdpr`) to `evaluate_control_rules.py`. Explicitly state that\n       the requested standard is not a standalone Assured Workloads Data\n       Boundary framework, explain the catalog scope boundary (Data Boundary\n       enforces regional data residency, SUR, CMEK, and sovereign support\n       routing rather than legal privacy or third-party certification audits),\n       and offer the closest adjacent `ASSURED_WORKLOADS` frameworks from\n       `frameworks.json` that match their active regional footprint (e.g.,\n       `builtin-il5` or `builtin-fedramp-high` for US defense\u002FCUI workloads, or\n       `builtin-eu-data-boundary-and-support` \u002F `builtin-eu-data-boundary` \u002F\n       `builtin-uk-data-boundary` for European\u002FUK regional residency).\n\n### Step 4: Conditional Pass 2 CMEK Ingestion & Org Policy Evaluation\n\n1. **Pass 2: Conditional Targeted Deep Ingestion for CMEK Resource Types**:\n   Derive `TARGET_TYPES` (the intersection of active CAI `assetType`s in\n   `macro_telemetry.json` and CMEK-governed services in `builtin-require-cmek`\n   from `frameworks.json`). Only 6 of the 38 Data Boundary frameworks include\n   `builtin-require-cmek`; if `TARGET_TYPES` is non-empty, fetch `kmsKeys`:\n   ```bash\n   TARGET_TYPES=$(python3 scripts\u002Fevaluate_control_rules.py \\\n     --get-target-asset-types \\\n     --framework=FRAMEWORK_ID \\\n     --telemetry-file=macro_telemetry.json \\\n     --frameworks-file=frameworks.json)\n\n   if [ -n \"${TARGET_TYPES}\" ]; then\n     gcloud asset search-all-resources \\\n       --scope=\"folders\u002FFOLDER_ID\" \\\n       --asset-types=\"${TARGET_TYPES}\" \\\n       --page-size=500 \\\n       --format=\"json(name,assetType,location,kmsKeys)\" > deep_telemetry.json\n   fi\n   ```\n2. **Execute High-Confidence Org Policy Evaluator**:\n   Run `scripts\u002Fevaluate_control_rules.py` over `macro_telemetry.json` (and\n   optional `deep_telemetry.json`) with `frameworks.json` to compute the 3\n   quantitative scores (`locationScore`, `serviceScore`, `cmekScore`,\n   `compositeScore`) and `orgPolicyDriftIndicators` (when `cmekRequired` is\n   `false`, always display the CMEK Readiness column as `N\u002FA` in the scorecard):\n   ```bash\n   python3 scripts\u002Fevaluate_control_rules.py \\\n     --telemetry-file=macro_telemetry.json \\\n     --deep-telemetry-file=deep_telemetry.json \\\n     --framework=FRAMEWORK_ID \\\n     --frameworks-file=frameworks.json\n   ```\n3. **Evaluate Operational & Governance Impact**:\n   * Review `cloudControlDetails` in `frameworks.json` for parameterized and\n     operational controls (`builtin-restrict-kms-protection-levels`,\n     `builtin-enforce-allowed-cmek-crypto-key-projects`,\n     `builtin-restrict-cloud-function-generations`,\n     `builtin-restrict-cloudstorage-auth-types`,\n     `builtin-iam-disable-service-account-key-creation`,\n     `builtin-disable-ssh-in-browser`, `builtin-enable-axt`, and\n     `*-regulatory-settings` controls like\n     `builtin-cloud-logging-regulatory-settings`) and summarize their workflow\n     impact in the final report.\n\n### Step 5: Render Executive Assessment Report (Minto Pyramid Structure)\n\nPresent an executive report structured around the **Minto Pyramid Principle**\n(Bottom Line Up Front -> Core Value Pillars -> Supporting Evidence -> Action\nPlan):\n\n```markdown\n# Compliance Environment Assessment Report: [Scope URI]\n\n## 1. Executive Conclusion & Recommendation (Bottom Line Up Front)\n* **Primary Recommendation**: [Framework Name] (`organizations\u002F{org_id}\u002Flocations\u002Fglobal\u002Fframeworks\u002F{framework_id}`)\n* **Org Policy Readiness Alignment**: [Composite Fit %]\n* **Recommended Deployment Mode**:\n  * **Existing Workloads (Folders or Projects)**: Deploy in **Monitoring (`Detective`) mode** first, then transition to **Preventive** mode after remediating findings.\n  * **New Workloads (Folders or Projects)**: Start in **Preventive** mode or **Monitoring (`Detective`) mode**.\n  * **Zero Production Outage Risk**: Monitoring (`Detective`) mode mutates zero Organization Policies on Day 0.\n  * **Continuous Server-Side CES Observability**: Activates real-time Continuous Evaluation Service (CES) monitoring across all framework controls.\n  * **No Migration Required**: Protects existing folders and projects in-place without migrating resources.\n\n---\n\n## 2. Core Value Drivers: Why Assured Workloads Fits This Scope\n1. **Residency & Boundary Alignment (`gcp.resourceLocations`)**: Active regional workloads are evaluated against allowed regions ([e.g. 100% US-contained]).\n2. **Service & API Compatibility (`gcp.restrictServiceUsage` \u002F SUR)**: Active service APIs are evaluated against accredited service allowlists ([e.g. 100% approved services]).\n3. **Non-Disruptive Posture Hardening**: Enrolling existing workloads in Monitoring (`Detective`) mode provides server-side CES posture evaluation while allowing your team to triage Org Policy readiness safely before moving to Preventive mode.\n\n---\n\n## 3. Objective Assessment Scorecard & Org Policy Readiness Triage\n\n### Quantitative Org Policy Readiness Scorecard\n| Candidate Framework | Location Residency (`locationScore`) | Service Usage \u002F SUR (`serviceScore`) | CMEK Readiness (`cmekScore`) | Composite Alignment | Personnel Support Model |\n| :--- | :--- | :--- | :--- | :--- | :--- |\n| **[Framework 1]** | [XX%] | [XX%] | [XX% or N\u002FA] | **[XX%]** | [Support Model] |\n| **[Framework 2]** | [XX%] | [XX%] | [XX% or N\u002FA] | **[XX%]** | [Support Model] |\n\n### Active Resource & Effective Org Policy Baseline\n* **Discovered Inventory**: [Total Assets count] across [Active resource types and regions].\n* **Effective Org Policy Baseline**: [Effective `gcp.resourceLocations`, `gcp.restrictServiceUsage`, and `gcp.restrictTLSVersion` posture].\n\n### Pre-Flight Org Policy Readiness Recommendations (Prior to Preventive Mode)\n*Pre-flight drift indicators do NOT block Day 0 deployment in Monitoring (`Detective`) mode. Address these prior to enabling Preventive policy enforcement (authoritative CES and REST control evaluations run server-side after deployment):*\n* **[Priority 1]**: [e.g. Configure CMEK keys on unencrypted resources before toggling `builtin-require-cmek` to `PREVENTIVE`].\n* **[Priority 2]**: [e.g. Operational impact of bound controls such as `builtin-restrict-kms-protection-levels` or `builtin-cloud-logging-regulatory-settings`].\n\n---\n\n## 4. Deployment Action Plan & Commercial Advisory\n\n### Deploy via Google Cloud Console — Assured Workloads Frameworks Tab (Recommended)\nReview and deploy the recommended framework directly in the Google Cloud Console **Assured Workloads -> Frameworks** tab:\n? **[Open Assured Workloads Frameworks Console](https:\u002F\u002Fconsole.cloud.google.com\u002Fcompliance\u002Fconfigure\u002Fframeworks?organizationId=ORGANIZATION_ID)**\n* **Existing Workloads (Folders or Projects)**: Deploy in **Monitoring (`Detective`) mode** to evaluate posture and remediate findings with zero Day 0 Organization Policy mutations, then transition to **Preventive** mode.\n* **New Workloads (Folders or Projects)**: Start directly in **Preventive** mode or in **Monitoring (`Detective`) mode**.\n\n### Commercial & Licensing Advisory\n* Assured Workloads compliance regimes may carry support routing or licensing entitlements depending on whether the framework enforces regional data location controls only (standard commercial support, $0 support uplift) or specifies support personnel access controls in its `displayName` and `description` (paid sovereign\u002Fregulated support).\n* Review full pricing details and entitlement tiers at: https:\u002F\u002Fcloud.google.com\u002Fassured-workloads\u002Fpricing\n```\n\n### Step 6: Handling Customer Follow-Up Questions on Specific Services\n\nWhen a customer follows up with a specific question about how a recommended or\ncandidate framework affects a particular Google Cloud service (e.g., Cloud Run,\nCloud Storage, Spanner, GKE, Cloud SQL, Vertex AI, Cloud Logging):\n1. **Inspect Cached `frameworks.json` Locally (or Fetch via Step 3 `frameworks list` if Not Cached)**:\n   * If `frameworks.json` is not yet present in the current working directory, run the Step 3 `gcloud compliance-manager frameworks list` command first to populate `frameworks.json`.\n   * Check whether `\u003Cservice>.googleapis.com` is permitted in\n     `builtin-enforce-service-usage-restrictions` (`allowedServices`) and\n     whether CMEK is required in `builtin-require-cmek` (`services`).\n   * Identify all service-specific `cloudControlDetails[].name` entries bound in\n     that framework (e.g., `builtin-run-disable-ephemeral-disk`,\n     `builtin-restrict-cloudstorage-auth-types`,\n     `builtin-disable-spanner-multi-region`,\n     `builtin-cloud-logging-regulatory-settings`) and any bound `parameters`.\n2. **Fetch Authoritative Control Details On Demand**:\n   * Because `Framework.cloudControlDetails` omits control descriptions,\n     enforcement modes, and remediation steps, run `cloud-controls describe` for\n     the relevant control ID(s):\n     ```bash\n     gcloud compliance-manager cloud-controls describe CONTROL_ID \\\n       --organization=ORGANIZATION_ID \\\n       --location=global \\\n       --format=\"json(name,displayName,description,supportedEnforcementModes,remediationSteps,parameterSpec)\"\n     ```\n   * Extract the exact underlying Organization Policy constraint (e.g.,\n     `run.managed.disableEphemeralDisk`, `storage.restrictAuthTypes`),\n     `supportedEnforcementModes` (`PREVENTIVE` vs. `DETECTIVE`), and\n     `remediationSteps` from the response.\n3. **Check Effective Folder\u002FProject Policy If Requested**:\n   * If the customer asks whether their folder already enforces that\n     service-specific Org Policy constraint, run:\n     ```bash\n     gcloud org-policies describe CONSTRAINT_NAME \\\n       --folder=FOLDER_ID \\\n       --effective \\\n       --format=\"json(name,spec.rules)\"\n     ```\n\n---\n\n## Failure Modes & Error Recovery Playbook\n\n| Error Condition | Immediate Action | User Recovery Guidance |\n| :--- | :--- | :--- |\n| **`USER_PROJECT_DENIED` or `serviceusage.serviceUsageConsumer`** | HALT discovery. Do not confuse with target scope permissions. Check administrative project billing status and caller quota permissions. | *\"The administrative project `PROJECT_ID` cannot be used for API quota. 1) Verify a Cloud Billing account is attached (`gcloud billing projects describe PROJECT_ID`), 2) Grant `roles\u002Fserviceusage.serviceUsageConsumer` on `PROJECT_ID` to your identity, or 3) Switch to a project you own: `gcloud config set project \u003CPROJECT_ID>`.\"* |\n| **`PERMISSION_DENIED` on CAIS** | HALT discovery immediately. Do not speculate or guess resources. | *\"To analyze this environment, grant `roles\u002Fcloudasset.viewer` on `folders\u002F123` to your active identity.\"* |\n| **`PERMISSION_DENIED` on Org Policies** | HALT policy inspection. Do not guess effective constraints. | *\"To inspect effective organization policies, grant `roles\u002Forgpolicy.policyViewer` on `folders\u002F123`.\"* |\n| **Empty Scope (0 Resources)** | HALT evaluation. Inform user the scope contains no active assets. | *\"No active resources found in `folders\u002F123`. Provision resources or select an active scope.\"* |\n| **Conflicting Regulatory Intent** | Engage user in focused clarification probe. | Present distinct requirements (e.g. DoD IL5 Adjudicated Support vs. ITAR US Persons) and ask for business requirement. |\n| **Zero Catalog Match** | Detail multi-regional drift indicator. | Explain why single-region sovereign data boundary frameworks were ruled out (e.g. multi-continental resource footprint spanning unapproved regions). |\n| **Out-of-Scope \u002F Non-Catalog Standard (e.g., CMMC, UK GDPR)** | Do not invent framework IDs (`builtin-cmmc`, `builtin-uk-gdpr`). Explain catalog boundary and map to adjacent `ASSURED_WORKLOADS` candidates. | *\"Assured Workloads does not include a standalone `[CMMC \u002F UK GDPR]` framework in `frameworks.json`. However, based on your active resources, we can evaluate an adjacent Assured Workloads Data Boundary framework such as `builtin-il5` \u002F `builtin-fedramp-high` (for US defense\u002Ffederal workloads) or `builtin-eu-data-boundary-and-support` \u002F `builtin-uk-data-boundary` (for European\u002FUK regional residency).\"* |\n","# Compliance Environment Assessor Skill\n\nThis skill performs zero-risk, non-mutating compliance discovery, physical telemetry profiling, and data boundary framework recommendation across Google Cloud Folders (`folders\u002F{folder_id}`) and Projects (`projects\u002F{project_id}`).\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Safety & Execution Tier (CRITICAL)\n\n* **Tier R (Strictly Read-Only)**:\n  All discovery operations execute read-only queries\n  (`gcloud asset search-all-resources`,\n  `gcloud compliance-manager frameworks list`,\n  `gcloud compliance-manager cloud-controls describe`, and\n  `gcloud org-policies describe --effective`).\n  You MUST NEVER execute mutating commands (`gcloud compliance-manager framework-deployments create`,\n  `gcloud org-policies set-policy`, or `gcloud resource-manager ...`).\n\n---\n\n## Grounding Guardrails: Google Cloud & Assured Workloads Precedence (CRITICAL)\n\nTo prevent hallucinations, incorrect compliance assessments, and false blockers derived from generic LLM pre-training, the agent is governed by strict **Grounding Guardrails**:\n\n1. **Strict Prohibition on Generic LLM Pre-Training Priors**:\n   * You MUST NOT derive compliance rules, API semantics, or deployment constraints from generic web pre-training (e.g., generic NIST\u002FFedRAMP certification audit checklists, AWS\u002FAzure architectures, or legacy on-prem IT auditor mindsets).\n   * In traditional IT audits, non-compliance is a binary go\u002Fno-go gate that\n     blocks deployment. In Google Cloud Assured Workloads, deploying in\n     **Monitoring (`Detective`) mode** enables detective controls without\n     mutating existing Organization Policies, allowing continuous observability\n     without halting Day 0 rollout. You MUST NOT confuse these paradigms.\n2. **Authoritative Assured Workloads Scope & Deployment Grounding**:\n   * Assured Workloads binds compliance frameworks directly to existing or new\n     Google Cloud folders (`folders\u002F...`) and projects (`projects\u002F...`).\n   * **Existing Workloads (Folders or Projects)**: Recommend deploying in\n     **Monitoring (`Detective`) mode** first to assess and remediate findings\n     safely without mutating existing Organization Policies, and then\n     transitioning to **Preventive** mode.\n   * **New Workloads (Folders or Projects)**: Recommend starting in\n     **Preventive** mode or **Monitoring (`Detective`) mode**.\n   * **Google Cloud Console Deployment**: Always guide the user to deploy the\n     recommended framework via the **Assured Workloads Frameworks tab in Google\n     Cloud Console**\n     (`https:\u002F\u002Fconsole.cloud.google.com\u002Fcompliance\u002Fconfigure\u002Fframeworks?organizationId=ORGANIZATION_ID`).\n     Do NOT recommend `gcloud assured workloads create` (which only provisions\n     new greenfield folders using legacy regime enums and cannot bind frameworks\n     to existing folders or projects).\n3. **Client-Side Org Policy Readiness vs. Server-Side CES Boundary**:\n   * **Client-Side Scope**: Pre-flight evaluation via\n     `scripts\u002Fevaluate_control_rules.py` assesses **ONLY the 3 high-confidence\n     Organization Policy parameter sets** bound in\n     `Framework.cloudControlDetails[].parameters`:\n     1. Resource Locations (`builtin-restrict-resource-locations` \u002F\n        `constraints\u002Fgcp.resourceLocations`)\n     2. Service Usage Restrictions \u002F SUR\n        (`builtin-enforce-service-usage-restrictions` \u002F\n        `constraints\u002Fgcp.restrictServiceUsage`)\n     3. CMEK Encryption Requirements (`builtin-require-cmek` \u002F\n        `constraints\u002Fgcp.restrictNonCmekServices`)\n   * **Server-Side CES Scope**: Complex Continuous Evaluation Service\n     (`ces_rule`) and REST API rules (`rest_api_measurement`) are evaluated\n     **server-side by the Continuous Evaluation Service (CES)** after the\n     framework is deployed.\n   * **Terminology Invariant**: You MUST frame client-side findings as\n     **Pre-Flight Org Policy Readiness Recommendations \u002F Potential Drift\n     Indicators** (`orgPolicyDriftIndicators`), NEVER as definitive compliance\n     \"violations\" or \"deployment blockers\" that could contradict an actual\n     post-deployment CES run.\n4. **Static Built-In Catalog, Session Caching, Support Routing & KAJ Flow**:\n   * Built-in Frameworks (`type: BUILT_IN`) returned by\n     `gcloud compliance-manager frameworks list` are static configurations\n     uniform across organizations. Fetch `frameworks.json` once per session and\n     reuse the cached file across all candidate evaluations and follow-up\n     queries.\n   * **Personnel Support Model**: Determine whether a framework requires a\n     **Paid Sovereign\u002FRegulated Support Subscription** or uses **Standard\n     Commercial Support** ($0 support uplift) from the framework's public\n     `displayName` and `description` in `frameworks.json`:\n     - **Paid Sovereign\u002FRegulated Support Subscription**: Frameworks whose\n       `description` specifies support personnel access controls (e.g.,\n       `\"Support access controls are set to ...\"`, `-and-support` variants\n       such as `builtin-eu-data-boundary-and-support` and\n       `builtin-us-data-boundary-and-support`, or regulated standards such as\n       `builtin-il4`, `builtin-il5`, `builtin-itar`, `builtin-fedramp-high`,\n       `builtin-cjis`).\n     - **Standard Commercial Support ($0 support uplift)**: Regional-only Data\n       Boundary frameworks whose `description` sets data location controls only\n       without a support access controls clause (e.g.,\n       `builtin-us-data-boundary`, `builtin-eu-data-boundary`,\n       `builtin-uk-data-boundary`, `builtin-japan-data-boundary`).\n     - **Important**: Do NOT use the mere presence of\n       `builtin-restrict-technical-support-services` in `cloudControlDetails`\n       as a discriminator, because both regional-only and paid-support Data\n       Boundary frameworks include that control.\n   * **Key Access Justifications (KAJ) & EKM**: Recommend\n     `-with-access-justifications` framework variants only when the customer\n     **explicitly requests KAJ\u002FEKM**, or when disambiguating between matching\n     regional variants in `frameworks.json`.\n5. **Deterministic Tool Gating**:\n   * You MUST NOT guess compatibility scores ($$S_{\\text{composite}}$$) or resource inventories.\n   * You MUST execute `scripts\u002Fevaluate_control_rules.py` with `--frameworks-file=frameworks.json`.\n\n## Prerequisites\n\nBefore executing environment assessment, ensure your local or Cloud Shell environment meets the following prerequisites:\n\n1. **Google Cloud SDK**:\n   * Install and initialize the latest Google Cloud CLI (`gcloud`): https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall.md.txt\n2. **Project Setup & Target Selection**:\n   * Select or configure an administrative project for running assessment queries:\n     ```bash\n     gcloud config set project PROJECT_ID\n     ```\n3. **Region Configuration & Availability**:\n   * Configure a well-supported default region (e.g. `us-central1`):\n     ```bash\n     gcloud config set compute\u002Fregion us-central1\n     ```\n   * Consult official region availability documentation: [Google Cloud Locations](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations).\n4. **Required API Enablement**:\n   * Enable the required Google Cloud APIs on the administrative project:\n     ```bash\n     gcloud services enable \\\n       cloudasset.googleapis.com \\\n       orgpolicy.googleapis.com \\\n       assuredworkloads.googleapis.com \\\n       cloudsecuritycompliance.googleapis.com\n     ```\n5. **Authentication Setup**:\n   * Authenticate your user or service account identity and establish application default credentials:\n     ```bash\n     gcloud auth login\n     gcloud auth application-default login\n     ```\n6. **Billing & Quota Project Setup (Zero Billing Impact)**:\n   * **Zero-Cost Assessment Guarantee**: Running this assessment incurs **$0 in\n     Google Cloud infrastructure and API billing charges**. All discovery\n     operations (`gcloud asset search-all-resources`,\n     `gcloud compliance-manager frameworks list`, and\n     `gcloud org-policies describe --effective`) are free read-only metadata\n     queries.\n   * **Quota Project Requirement**: Google Cloud Service Infrastructure requires an administrative project with an active Cloud Billing account attached to allocate API rate limits and meter service usage (sent via the `X-Goog-User-Project` header), even for free APIs.\n   * **Pre-Flight Verification**:\n     ```bash\n     # 1. Verify active Cloud Billing account is attached to administrative project\n     gcloud billing projects describe PROJECT_ID --format=\"value(billingEnabled)\"\n\n     # 2. If using a shared project, ensure your user identity has permission to consume project quota\n     gcloud projects add-iam-policy-binding PROJECT_ID \\\n       --member=\"user:USER_EMAIL\" \\\n       --role=\"roles\u002Fserviceusage.serviceUsageConsumer\"\n\n     # 3. Synchronize Application Default Credentials quota project\n     gcloud auth application-default set-quota-project PROJECT_ID\n     ```\n7. **Commands & Payloads Reference**:\n   * Consult the [Google Cloud CLI Commands Reference](references\u002Fgcloud-commands.md) for full server-side projection masks, field filters, and API payload definitions.\n\n---\n\n## Step-by-Step Operating Workflow\n\n### Step 1: Ingest Scope & Resolve Organization ID\n\n1. Accept or prompt for the target scope (`folders\u002F{folder_id}` or `projects\u002F{project_id}`). If the user provides an open-ended scope without stating a regulatory regime, DO NOT block on broad questionnaires. Proceed immediately to ingest telemetry.\n2. Automatically resolve the parent Organization ID from the scope to drive downstream catalog queries:\n   * **For Folders**:\n     ```bash\n     gcloud resource-manager folders describe FOLDER_ID --format=\"value(parent)\"\n     ```\n     *(If the parent is another folder, traverse up ancestors until `organizations\u002F{org_id}` is found)*\n   * **For Projects**:\n     ```bash\n     gcloud projects get-ancestors PROJECT_ID --format=\"value(id,type)\"\n     ```\n\n### Step 2: Ingest Asset Telemetry & Effective Org Policies via Two-Pass Telescoping Protocol\n\nTo guarantee 100% coverage across the scope hierarchy while keeping payloads compact, telemetry ingestion executes in two telescoping passes (see [Google Cloud CLI Commands Reference](references\u002Fgcloud-commands.md)):\n\n1. **Pass 1: Macro Footprint & API Enumeration (100% Scope Coverage)**:\n   ```bash\n   gcloud asset search-all-resources \\\n     --scope=\"folders\u002FFOLDER_ID\" \\\n     --page-size=500 \\\n     --format=\"json(name,assetType,location)\" > macro_telemetry.json\n   ```\n   * *Pagination & Scope Semantics*: `--page-size=500` fetches 500 cloud assets\n     per HTTP API page (the maximum batch size permitted by Cloud Asset\n     Inventory), automatically paginating through all assets strictly inside\n     `folders\u002FFOLDER_ID` and its descendant projects.\n   * *Full Location & SUR Coverage*: `macro_telemetry.json` captures 100% of\n     active `location` and `assetType` values required to evaluate both\n     `builtin-restrict-resource-locations` (`allowedLocations`) and\n     `builtin-enforce-service-usage-restrictions` (`allowedServices` \u002F SUR).\n   * If `PERMISSION_DENIED` is returned:\n     - If the error states `USER_PROJECT_DENIED` or references `roles\u002Fserviceusage.serviceUsageConsumer`, the error is on the **administrative quota project** (it lacks an attached billing account or caller lacks `serviceUsageConsumer`). Follow the Quota Project Recovery playbook and stop running further commands.\n     - If the error references the target scope (`folders\u002F...` or `projects\u002F...`), HALT ALL TOOL CALLS IMMEDIATELY (do not run Step 2.2, Step 3, or any further commands) and inform the user they require `roles\u002Fcloudasset.viewer` and `roles\u002Forgpolicy.policyViewer` on that scope.\n   * If 0 resources are returned, inform the user the target scope is empty.\n\n2. **Inspect Effective Universal Org Policies on Scope (`38\u002F38` Frameworks)**:\n   ```bash\n   gcloud org-policies describe gcp.resourceLocations \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_locations.json\n\n   gcloud org-policies describe gcp.restrictServiceUsage \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_services.json\n\n   gcloud org-policies describe gcp.restrictTLSVersion \\\n     --folder=FOLDER_ID \\\n     --effective \\\n     --format=\"json(name,spec.rules)\" > effective_tls.json\n   ```\n\n### Step 3: Fetch & Cache Built-In Framework Catalog and Filter by Location + SUR\n\n1. **Fetch & Cache Built-In Framework Catalog (with Bound Parameters)**:\n   ```bash\n   if [ ! -s frameworks.json ]; then\n     gcloud compliance-manager frameworks list \\\n       --organization=ORGANIZATION_ID \\\n       --location=global \\\n       --filter=\"category:ASSURED_WORKLOADS\" \\\n       --format=\"json(name,majorRevisionId,displayName,description,category,cloudControlDetails)\" > frameworks.json\n   fi\n   ```\n   * *Session Caching*: Because built-in `ASSURED_WORKLOADS` frameworks are\n     static definitions uniform across organizations, cache the output in\n     `frameworks.json` and reuse it for all candidate evaluations and follow-up\n     questions.\n2. **Filter Candidates by Location + SUR Footprint & Clarify Intent**:\n   * Exclude location-less control-plane management metadata\n     (`cloudresourcemanager.googleapis.com\u002F*`, `orgpolicy.googleapis.com\u002F*`,\n     `cloudasset.googleapis.com\u002F*`, `accesscontextmanager.googleapis.com\u002F*`, and\n     `location: \"global\"` hierarchy nodes) from data-plane location checks.\n   * Match active data-plane regions (`location`) and active service prefixes\n     (`assetType`) from `macro_telemetry.json` against each framework's\n     `builtin-restrict-resource-locations` (`allowedLocations`) and\n     `builtin-enforce-service-usage-restrictions` (`allowedServices` \u002F SUR)\n     parameters in `frameworks.json`:\n     * **US-Only Regions (`us-central1`, `us-east4`)**: Candidates include DoD\n       IL5 (`builtin-il5`, adjudicated support), ITAR (`builtin-itar`, US\n       persons support), FedRAMP High\u002FModerate, or US Regional Data Boundary\n       (`builtin-us-data-boundary`, standard commercial support).\n     * **EU-Only Regions (`europe-west3`, `europe-west1`)**: Candidates include\n       EU Data Boundary and Support (`builtin-eu-data-boundary-and-support`) vs.\n       standard EU Regional Boundary (`builtin-eu-data-boundary`).\n   * **Targeted Disambiguation**:\n     * If multiple frameworks match the physical footprint and user regulatory\n       intent is unstated (e.g., an open-ended request with no regime specified),\n       DO NOT finalize a single primary recommendation yet — present the matching\n       candidate frameworks and STOP to ask the user a targeted clarifying\n       question about their regulatory intent (e.g., EU Sovereignty, US\n       FedRAMP\u002FIL5) and personnel support model (Standard Commercial Support vs.\n       Paid Sovereign\u002FRegulated Support).\n     * Recommend `-with-access-justifications` (KAJ\u002FEKM) framework variants only\n       if the customer explicitly asks for KAJ\u002FEKM or when disambiguating\n       between matching regional variants.\n     * **Out-of-Scope \u002F Non-Catalog Compliance Standards (e.g., CMMC, UK\n       GDPR)**:\n       If the user asks to evaluate a compliance standard or legal certification\n       that is not present as a built-in `ASSURED_WORKLOADS` framework in\n       `frameworks.json` (such as CMMC, UK GDPR, SOC 2, or PCI-DSS), DO NOT\n       fabricate or pass non-existent framework IDs (e.g., `builtin-cmmc` or\n       `builtin-uk-gdpr`) to `evaluate_control_rules.py`. Explicitly state that\n       the requested standard is not a standalone Assured Workloads Data\n       Boundary framework, explain the catalog scope boundary (Data Boundary\n       enforces regional data residency, SUR, CMEK, and sovereign support\n       routing rather than legal privacy or third-party certification audits),\n       and offer the closest adjacent `ASSURED_WORKLOADS` frameworks from\n       `frameworks.json` that match their active regional footprint (e.g.,\n       `builtin-il5` or `builtin-fedramp-high` for US defense\u002FCUI workloads, or\n       `builtin-eu-data-boundary-and-support` \u002F `builtin-eu-data-boundary` \u002F\n       `builtin-uk-data-boundary` for European\u002FUK regional residency).\n\n### Step 4: Conditional Pass 2 CMEK Ingestion & Org Policy Evaluation\n\n1. **Pass 2: Conditional Targeted Deep Ingestion for CMEK Resource Types**:\n   Derive `TARGET_TYPES` (the intersection of active CAI `assetType`s in\n   `macro_telemetry.json` and CMEK-governed services in `builtin-require-cmek`\n   from `frameworks.json`). Only 6 of the 38 Data Boundary frameworks include\n   `builtin-require-cmek`; if `TARGET_TYPES` is non-empty, fetch `kmsKeys`:\n   ```bash\n   TARGET_TYPES=$(python3 scripts\u002Fevaluate_control_rules.py \\\n     --get-target-asset-types \\\n     --framework=FRAMEWORK_ID \\\n     --telemetry-file=macro_telemetry.json \\\n     --frameworks-file=frameworks.json)\n\n   if [ -n \"${TARGET_TYPES}\" ]; then\n     gcloud asset search-all-resources \\\n       --scope=\"folders\u002FFOLDER_ID\" \\\n       --asset-types=\"${TARGET_TYPES}\" \\\n       --page-size=500 \\\n       --format=\"json(name,assetType,location,kmsKeys)\" > deep_telemetry.json\n   fi\n   ```\n2. **Execute High-Confidence Org Policy Evaluator**:\n   Run `scripts\u002Fevaluate_control_rules.py` over `macro_telemetry.json` (and\n   optional `deep_telemetry.json`) with `frameworks.json` to compute the 3\n   quantitative scores (`locationScore`, `serviceScore`, `cmekScore`,\n   `compositeScore`) and `orgPolicyDriftIndicators` (when `cmekRequired` is\n   `false`, always display the CMEK Readiness column as `N\u002FA` in the scorecard):\n   ```bash\n   python3 scripts\u002Fevaluate_control_rules.py \\\n     --telemetry-file=macro_telemetry.json \\\n     --deep-telemetry-file=deep_telemetry.json \\\n     --framework=FRAMEWORK_ID \\\n     --frameworks-file=frameworks.json\n   ```\n3. **Evaluate Operational & Governance Impact**:\n   * Review `cloudControlDetails` in `frameworks.json` for parameterized and\n     operational controls (`builtin-restrict-kms-protection-levels`,\n     `builtin-enforce-allowed-cmek-crypto-key-projects`,\n     `builtin-restrict-cloud-function-generations`,\n     `builtin-restrict-cloudstorage-auth-types`,\n     `builtin-iam-disable-service-account-key-creation`,\n     `builtin-disable-ssh-in-browser`, `builtin-enable-axt`, and\n     `*-regulatory-settings` controls like\n     `builtin-cloud-logging-regulatory-settings`) and summarize their workflow\n     impact in the final report.\n\n### Step 5: Render Executive Assessment Report (Minto Pyramid Structure)\n\nPresent an executive report structured around the **Minto Pyramid Principle**\n(Bottom Line Up Front -> Core Value Pillars -> Supporting Evidence -> Action\nPlan):\n\n```markdown\n# Compliance Environment Assessment Report: [Scope URI]\n\n## 1. Executive Conclusion & Recommendation (Bottom Line Up Front)\n* **Primary Recommendation**: [Framework Name] (`organizations\u002F{org_id}\u002Flocations\u002Fglobal\u002Fframeworks\u002F{framework_id}`)\n* **Org Policy Readiness Alignment**: [Composite Fit %]\n* **Recommended Deployment Mode**:\n  * **Existing Workloads (Folders or Projects)**: Deploy in **Monitoring (`Detective`) mode** first, then transition to **Preventive** mode after remediating findings.\n  * **New Workloads (Folders or Projects)**: Start in **Preventive** mode or **Monitoring (`Detective`) mode**.\n  * **Zero Production Outage Risk**: Monitoring (`Detective`) mode mutates zero Organization Policies on Day 0.\n  * **Continuous Server-Side CES Observability**: Activates real-time Continuous Evaluation Service (CES) monitoring across all framework controls.\n  * **No Migration Required**: Protects existing folders and projects in-place without migrating resources.\n\n---\n\n## 2. Core Value Drivers: Why Assured Workloads Fits This Scope\n1. **Residency & Boundary Alignment (`gcp.resourceLocations`)**: Active regional workloads are evaluated against allowed regions ([e.g. 100% US-contained]).\n2. **Service & API Compatibility (`gcp.restrictServiceUsage` \u002F SUR)**: Active service APIs are evaluated against accredited service allowlists ([e.g. 100% approved services]).\n3. **Non-Disruptive Posture Hardening**: Enrolling existing workloads in Monitoring (`Detective`) mode provides server-side CES posture evaluation while allowing your team to triage Org Policy readiness safely before moving to Preventive mode.\n\n---\n\n## 3. Objective Assessment Scorecard & Org Policy Readiness Triage\n\n### Quantitative Org Policy Readiness Scorecard\n| Candidate Framework | Location Residency (`locationScore`) | Service Usage \u002F SUR (`serviceScore`) | CMEK Readiness (`cmekScore`) | Composite Alignment | Personnel Support Model |\n| :--- | :--- | :--- | :--- | :--- | :--- |\n| **[Framework 1]** | [XX%] | [XX%] | [XX% or N\u002FA] | **[XX%]** | [Support Model] |\n| **[Framework 2]** | [XX%] | [XX%] | [XX% or N\u002FA] | **[XX%]** | [Support Model] |\n\n### Active Resource & Effective Org Policy Baseline\n* **Discovered Inventory**: [Total Assets count] across [Active resource types and regions].\n* **Effective Org Policy Baseline**: [Effective `gcp.resourceLocations`, `gcp.restrictServiceUsage`, and `gcp.restrictTLSVersion` posture].\n\n### Pre-Flight Org Policy Readiness Recommendations (Prior to Preventive Mode)\n*Pre-flight drift indicators do NOT block Day 0 deployment in Monitoring (`Detective`) mode. Address these prior to enabling Preventive policy enforcement (authoritative CES and REST control evaluations run server-side after deployment):*\n* **[Priority 1]**: [e.g. Configure CMEK keys on unencrypted resources before toggling `builtin-require-cmek` to `PREVENTIVE`].\n* **[Priority 2]**: [e.g. Operational impact of bound controls such as `builtin-restrict-kms-protection-levels` or `builtin-cloud-logging-regulatory-settings`].\n\n---\n\n## 4. Deployment Action Plan & Commercial Advisory\n\n### Deploy via Google Cloud Console — Assured Workloads Frameworks Tab (Recommended)\nReview and deploy the recommended framework directly in the Google Cloud Console **Assured Workloads -> Frameworks** tab:\n? **[Open Assured Workloads Frameworks Console](https:\u002F\u002Fconsole.cloud.google.com\u002Fcompliance\u002Fconfigure\u002Fframeworks?organizationId=ORGANIZATION_ID)**\n* **Existing Workloads (Folders or Projects)**: Deploy in **Monitoring (`Detective`) mode** to evaluate posture and remediate findings with zero Day 0 Organization Policy mutations, then transition to **Preventive** mode.\n* **New Workloads (Folders or Projects)**: Start directly in **Preventive** mode or in **Monitoring (`Detective`) mode**.\n\n### Commercial & Licensing Advisory\n* Assured Workloads compliance regimes may carry support routing or licensing entitlements depending on whether the framework enforces regional data location controls only (standard commercial support, $0 support uplift) or specifies support personnel access controls in its `displayName` and `description` (paid sovereign\u002Fregulated support).\n* Review full pricing details and entitlement tiers at: https:\u002F\u002Fcloud.google.com\u002Fassured-workloads\u002Fpricing\n```\n\n### Step 6: Handling Customer Follow-Up Questions on Specific Services\n\nWhen a customer follows up with a specific question about how a recommended or\ncandidate framework affects a particular Google Cloud service (e.g., Cloud Run,\nCloud Storage, Spanner, GKE, Cloud SQL, Vertex AI, Cloud Logging):\n1. **Inspect Cached `frameworks.json` Locally (or Fetch via Step 3 `frameworks list` if Not Cached)**:\n   * If `frameworks.json` is not yet present in the current working directory, run the Step 3 `gcloud compliance-manager frameworks list` command first to populate `frameworks.json`.\n   * Check whether `\u003Cservice>.googleapis.com` is permitted in\n     `builtin-enforce-service-usage-restrictions` (`allowedServices`) and\n     whether CMEK is required in `builtin-require-cmek` (`services`).\n   * Identify all service-specific `cloudControlDetails[].name` entries bound in\n     that framework (e.g., `builtin-run-disable-ephemeral-disk`,\n     `builtin-restrict-cloudstorage-auth-types`,\n     `builtin-disable-spanner-multi-region`,\n     `builtin-cloud-logging-regulatory-settings`) and any bound `parameters`.\n2. **Fetch Authoritative Control Details On Demand**:\n   * Because `Framework.cloudControlDetails` omits control descriptions,\n     enforcement modes, and remediation steps, run `cloud-controls describe` for\n     the relevant control ID(s):\n     ```bash\n     gcloud compliance-manager cloud-controls describe CONTROL_ID \\\n       --organization=ORGANIZATION_ID \\\n       --location=global \\\n       --format=\"json(name,displayName,description,supportedEnforcementModes,remediationSteps,parameterSpec)\"\n     ```\n   * Extract the exact underlying Organization Policy constraint (e.g.,\n     `run.managed.disableEphemeralDisk`, `storage.restrictAuthTypes`),\n     `supportedEnforcementModes` (`PREVENTIVE` vs. `DETECTIVE`), and\n     `remediationSteps` from the response.\n3. **Check Effective Folder\u002FProject Policy If Requested**:\n   * If the customer asks whether their folder already enforces that\n     service-specific Org Policy constraint, run:\n     ```bash\n     gcloud org-policies describe CONSTRAINT_NAME \\\n       --folder=FOLDER_ID \\\n       --effective \\\n       --format=\"json(name,spec.rules)\"\n     ```\n\n---\n\n## Failure Modes & Error Recovery Playbook\n\n| Error Condition | Immediate Action | User Recovery Guidance |\n| :--- | :--- | :--- |\n| **`USER_PROJECT_DENIED` or `serviceusage.serviceUsageConsumer`** | HALT discovery. Do not confuse with target scope permissions. Check administrative project billing status and caller quota permissions. | *\"The administrative project `PROJECT_ID` cannot be used for API quota. 1) Verify a Cloud Billing account is attached (`gcloud billing projects describe PROJECT_ID`), 2) Grant `roles\u002Fserviceusage.serviceUsageConsumer` on `PROJECT_ID` to your identity, or 3) Switch to a project you own: `gcloud config set project \u003CPROJECT_ID>`.\"* |\n| **`PERMISSION_DENIED` on CAIS** | HALT discovery immediately. Do not speculate or guess resources. | *\"To analyze this environment, grant `roles\u002Fcloudasset.viewer` on `folders\u002F123` to your active identity.\"* |\n| **`PERMISSION_DENIED` on Org Policies** | HALT policy inspection. Do not guess effective constraints. | *\"To inspect effective organization policies, grant `roles\u002Forgpolicy.policyViewer` on `folders\u002F123`.\"* |\n| **Empty Scope (0 Resources)** | HALT evaluation. Inform user the scope contains no active assets. | *\"No active resources found in `folders\u002F123`. Provision resources or select an active scope.\"* |\n| **Conflicting Regulatory Intent** | Engage user in focused clarification probe. | Present distinct requirements (e.g. DoD IL5 Adjudicated Support vs. ITAR US Persons) and ask for business requirement. |\n| **Zero Catalog Match** | Detail multi-regional drift indicator. | Explain why single-region sovereign data boundary frameworks were ruled out (e.g. multi-continental resource footprint spanning unapproved regions). |\n| **Out-of-Scope \u002F Non-Catalog Standard (e.g., CMMC, UK GDPR)** | Do not invent framework IDs (`builtin-cmmc`, `builtin-uk-gdpr`). Explain catalog boundary and map to adjacent `ASSURED_WORKLOADS` candidates. | *\"Assured Workloads does not include a standalone `[CMMC \u002F UK GDPR]` framework in `frameworks.json`. However, based on your active resources, we can evaluate an adjacent Assured Workloads Data Boundary framework such as `builtin-il5` \u002F `builtin-fedramp-high` (for US defense\u002Ffederal workloads) or `builtin-eu-data-boundary-and-support` \u002F `builtin-uk-data-boundary` (for European\u002FUK regional residency).\"* |\n",{"name":5,"metadata":52,"description":7},{"version":53,"category":54},"1.0.2","SecurityAndCompliance","main","cb11c49ce1076788d69115a9f001b07b4ba0b616","skills\u002Fcloud\u002Fassuredworkloads-environment-assessor",2014,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 23:31:00",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add google\u002Fskills --skill assuredworkloads-environment-assessor",{"tool":70,"command":71},"bunx","bunx skills add google\u002Fskills --skill assuredworkloads-environment-assessor",{"tool":73,"command":74},"pnpm","pnpm dlx skills add google\u002Fskills --skill assuredworkloads-environment-assessor","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002FSKILL.md",true,[78,84,88,94],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fattribution.md","REFERENCE","参考文档",1959,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002Freferences\u002Fattribution.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fgcloud-commands.md",4652,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002Freferences\u002Fgcloud-commands.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fevaluate_control_rules.py","SCRIPT","脚本",18624,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002Fscripts\u002Fevaluate_control_rules.py",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fvalidate_workload_payload.py",11320,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fassuredworkloads-environment-assessor\u002Fscripts\u002Fvalidate_workload_payload.py",[99,136,165,194,221,246],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":113,"publishedAt":47},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[105,110],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000010","后端与接口",[9,114,115,116,117,118,119,120,121,46,122,123,124,125,126,127,128,129,130,131,132,133,134,135],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":149,"publishedAt":47},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[142,143,146],{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":144,"categoryName":145,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000030","开发工程师",[150,151,9,46,152,153,154,155,156,157,127,158,159,160,161,162,163,132,135,164,27],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":177,"publishedAt":47},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[171,172,175,176],{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":173,"categoryName":174,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":144,"categoryName":145,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},[178,179,180,181,46,182,183,184,185,186,187,188,189,27,190,191,192,127,193,128],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":200,"publishedAt":47},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[201,202,203,204,205,206,207,208,124,209,210,211,212,213,214,187,215,216,217,27,218,219,192,220],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":230,"publishedAt":47},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[227,228,229],{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":144,"categoryName":145,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},[9,231,232,233,234,164,235,236,237,238,239,154,240,241,242,188,243,244,27,245,191],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","use","database","candidate",{"skillNo":247,"name":248,"nameZh":6,"description":249,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":250,"categories":251,"keywords":254,"publishedAt":47},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[252,253],{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},{"categoryNo":144,"categoryName":145,"taxonomyType":108,"taxonomyTypeDesc":109},[255,256,131,257,9,181,258,46,182,259,260,261,262,27,263,191,127,264,265,266,267],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]