> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/agentic-access/credential-sources/gcp-wif.md).

# GCP Workload Identity Federation

Install the GCP Workload Identity Federation component so P0 can grant and revoke Google Cloud access for OIDC-authenticated agents running through the P0 AI Gateway.

The **GCP Workload Identity Federation** integration lets P0 grant and revoke Google Cloud access for OIDC-authenticated agents. It creates a Workload Identity Pool and OIDC provider in your Google Cloud project, so an agent reaching Google Cloud through the [P0 Runtime Access for AI](/readme/agentic-control-plane.md) gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable **agentic access to Google Cloud through the gateway**. The OIDC provider you register here is the gateway's own identity: the gateway signs a token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates.

{% hint style="info" %}
This component is in **preview**. It supports agentic access via the P0 AI Gateway and is a prerequisite for exposing Google Cloud to agents behind the gateway.
{% endhint %}

## Prerequisites

* The base [Google Cloud](/integrations/resource-integrations/google-cloud.md) integration with **IAM management** installed on the same project. GCP Workload Identity Federation builds on that integration's IAM-write access, and the project picker only lists projects where it's already installed.
* A deployed P0 AI Gateway. The **OIDC provider URL** you enter below is that deployment's own OIDC issuer, so install this component after the gateway. See [Deploying the gateway](/agentic-access/agentic-gateway/gateway/deploy.md).
* Permission to apply Terraform (or run the equivalent `gcloud` commands) in the target Google Cloud project, to create a Workload Identity Pool and provider.

## Install the Workload Identity Federation component

1. Navigate to **Integrations** on [p0.app](https://p0.app), select **GCP Workload Identity Federation**, and choose the **Workload Identity Federation** component.
2. Click **Add identity provider**.
3. Fill in the identity provider details, then click **Next**:

   * **Identifier**: a name for this identity provider within P0 (for example, the name of the gateway environment it serves). P0 derives the Workload Identity Pool and provider IDs from this name.
   * **GCP project ID**: the project to install into. The dropdown lists the projects where the base Google Cloud integration's IAM management is installed.
   * **OIDC provider URL**: your gateway's OIDC issuer URL, which is the gateway's public base URL.

   P0 derives the **Audience** automatically from the Workload Identity Pool provider it creates, so you don't enter it.
4. P0 generates a Terraform configuration. Copy it into your Terraform project, `apply` it, then click **Next**.

   The generated configuration creates the Workload Identity Pool and OIDC provider that Google Cloud uses to trust the gateway's tokens:

   ```hcl
   resource "google_iam_workload_identity_pool" "p0_wif_pool" {
     project                   = local.project_id
     workload_identity_pool_id = "p0-wif-pool-<identifier>"
   }

   resource "google_iam_workload_identity_pool_provider" "p0_wif_provider" {
     project                            = local.project_id
     workload_identity_pool_id          = google_iam_workload_identity_pool.p0_wif_pool.workload_identity_pool_id
     workload_identity_pool_provider_id = "p0-wif-provider-<identifier>"

     attribute_mapping = {
       "google.subject" = "assertion.sub"
     }

     oidc {
       issuer_uri = local.oidc_provider_url
     }
   }
   ```

   The provider doesn't set `allowed_audiences`, so Google Cloud accepts tokens whose `aud` claim is the provider's own full resource name. P0 uses that resource name as the audience automatically.
5. Review the read-only summary and click **Finish**.
6. The identity provider now appears with the state **Installed**.

## How it works

When an agent requests Google Cloud access through the gateway, P0 adds the federated principal as an IAM member on the target resources, scoped to the token's subject (`sub`). The gateway signs an OIDC token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates. P0 never issues long-lived Google Cloud credentials to the agent, and removes the IAM binding when the session ends or the agent relinquishes it.

The `sub` changes with every session and caller, and Google matches IAM members by exact subject, so you can't pre-bind a fixed value. P0 creates the binding per session.

## Next steps

* Configure a [GCP](/agentic-access/agentic-gateway/mcp-server/gcp.md) to expose Google Cloud to agents behind the gateway, using this Workload Identity Federation identity as its credential provider.