> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/credential-sources/gcp-service-account-creator.md).

# GCP Service Account Creator

Install the GCP Service Account Creator so P0 can create a short-lived Google Cloud service account for each agent grant made through the P0 AI Gateway.

The **GCP Service Account Creator** lets P0 give an agent its own Google identity for the length of one grant. When an agent behind the [AI gateway](/agentic-access/agentic-gateway.md) is granted access to a service that only accepts a named account, such as [Google Drive](/agentic-access/agentic-gateway/mcp-server/google-drive.md), P0 creates a new service account in a project you choose, grants access to that account, and lets the gateway act as it for that session. When the grant ends, P0 deletes the account.

No agent or user ever receives a key for these accounts. Only the gateway session that requested the grant can act as the account.

You don't request access through this integration directly. Other integrations use it, so install it before any integration that lists it as a prerequisite.

{% hint style="info" %}
The GCP Service Account Creator is a beta feature.
{% endhint %}

## Prerequisites

* The base [Google Cloud](/integrations/resource-integrations/google-cloud.md) integration with **IAM management** installed on the project you'll use. The project picker only lists these projects.
* [GCP Workload Identity Federation](/agentic-access/credential-sources/gcp-wif.md) installed on the same project. P0 refuses a project without it, because the gateway reaches each service account through that project's identity pool.
* These APIs enabled in the project. The Terraform P0 generates doesn't enable them for you:
  * `cloudresourcemanager.googleapis.com`
  * `iam.googleapis.com`
  * `run.googleapis.com`
* Permission to apply Terraform in the project.

Choose a project you can dedicate to agent identities. P0 creates and deletes service accounts there on every grant, and other integrations that build on this one run in the same project.

## Install the GCP Service Account Creator

1. Navigate to **Integrations** on [p0.app](https://p0.app), select **GCP Service Account Creator**, and choose the **Agentic identities** component.
2. Click to add a project, select the Google Cloud project, then click **Next**.
3. P0 generates a Terraform configuration. Copy it into your Terraform project, `apply` it, then click **Next**.

   The configuration creates:

   * A custom role, **P0 agentic identity manager** (`p0AgenticIdentityManager`), with these permissions only:
     * `iam.serviceAccounts.create`
     * `iam.serviceAccounts.delete`
     * `iam.serviceAccounts.get`
     * `iam.serviceAccounts.getIamPolicy`
     * `iam.serviceAccounts.setIamPolicy`
     * `resourcemanager.projects.get`
   * A service account, `p0-service-account-connector`, bound to that role on this project and nowhere else.
   * A Cloud Run service, `p0-connector-gcp-service-account`, that runs P0's connector as that service account.
   * An invoker binding that lets P0's Google Cloud service account, and no one else, call the connector.

   The role can't create or read service account keys.
4. P0 checks that the connector is deployed and reachable. A new Cloud Run service can take a minute to start, and P0 keeps checking until it responds.
5. Review the read-only summary and click **Finish**.
6. The project now appears with the state **Installed**.

## Service accounts P0 creates

Each grant gets its own service account, named `p0a-<adjective>-<animal>-<suffix>@<project-id>.iam.gserviceaccount.com`, for example `p0a-agile-otter-1f2e3d4c@my-project.iam.gserviceaccount.com`. P0 never reuses one, and deletes it when the grant ends.

Only the gateway session the grant was made for can impersonate the account. These accounts appear in the destination service's own audit logs, such as Drive activity, so you can trace an agent's actions back to a single grant.

## Next steps

* Install [Google Drive](/agentic-access/agentic-gateway/mcp-server/google-drive.md) to let agents request access to folders and files in your shared drives.