>
    Strata Copilot
    Gemini Agent Studio and AI Red Teaming Integration
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Red Teaming
    4. Identify AI System Risks with AI Red Teaming
    5. Get Started with Prisma AIRS AI Red Teaming
    6. Targets
    7. Third-party Registration and Integration
    8. Gemini Agent Studio and AI Red Teaming Integration
    Download PDF
    Prisma AIRS

    Gemini Agent Studio and AI Red Teaming Integration

    Table of Contents

    Gemini Agent Studio and AI Red Teaming Integration

    Configure Google Cloud IAM to allow AI Red Teaming to reach and test agents built in Gemini Agent Studio (Reasoning Engine).
    Where Can I Use This?What Do I Need?
    • Prisma AIRS (AI Red Teaming)
    • Prisma AIRS AI Red Teaming license
    • Prisma AIRS AI Red Teaming deployment profile
    • A GCP project with a Reasoning Engine agent deployed in Gemini Agent Studio
    • Permission to create custom roles, service accounts, and manage IAM in that GCP project
    Gemini Agent Studio (previously Vertex AI Agent Studio, now also called Agent Platform) lets you build no-code and low-code AI agents that run as Reasoning Engine deployments in your Google Cloud project. AI Red Teaming connects to these agents through the Vertex AI API using GCP service account impersonation. You create a dedicated service account and custom IAM role in your project, then grant AI Red Teaming's connector service account the right to impersonate it. You do not need to register an OAuth 2.0 application, configure redirect URIs, or share any credentials.

    Configure GCP IAM

    Before running a scan, check the Query Reasoning Engine requests per minute per region quota in IAM & AdminQuotas & System Limits for your GCP project. This limit applies per project per region and is shared across all Reasoning Engine agents in that region. The AI Red teaming scan can consume quota that also affects your other Reasoning Engine agents running in the same region.
    Complete the following steps in your GCP project before you add a Gemini Agent Studio agent as a target in AI Red Teaming.
    1. Create a custom IAM role scoped to the six permissions required to invoke a Reasoning Engine agent and manage its sessions.
      1. In the Google Cloud console, open the project where your agent is deployed.
      2. Select IAM & AdminRoles, filter by Custom, then select + Create Custom Role.
      3. Provide a Title and ID, and set Role launch stage to General Availability.
        For example:
        • Title: Agent Platform Custom Role (red-teaming)
        • ID: AgentPlatformCustomRole
        • Role launch stage: General Availability
      4. Select + Add Permissions. Filter by aiplatform.session and aiplatform.reasoningEngines to locate the permissions, then add all six:
        • aiplatform.reasoningEngines.get
        • aiplatform.reasoningEngines.query
        • aiplatform.sessions.create
        • aiplatform.sessions.get
        • aiplatform.sessionEvents.append
        • aiplatform.sessionEvents.list
      5. Select Create.
    2. Create a service account and assign the custom role. This is the service account that AI Red Teaming impersonates to reach your agent.
      1. Select IAM & AdminService Accounts, then select + Create service account.
      2. Provide a Service account name, Service account ID, and optional Service account description, then select Create and continue.
        For Example:
        • Service account name: airt-caller (or your preferred name)
        • Service account ID: airt-caller → airt-caller@YOUR-PROJECT.iam.gserviceaccount.com
        • (optional)Description: AI Red Teaming agent caller
      3. In the Permissions section, select the custom role you created in Step 1 from the Role.
      4. Copy the service account email address (format: account-name@YOUR-PROJECT.iam.gserviceaccount.com). You need it in Step 3 and when configuring the target in AI Red Teaming.
    3. Grant the AI Red Teaming connector service account impersonation access. Grant the Service Account Token Creator role to AI Red Teaming's regional connector service account, scoped to your service account (not project-wide). This allows the connector to generate short-lived access tokens and call your agent as your service account.
      1. Open the service account you created in Step 2.
      2. Select Principals with accessView by principalsGrant access.
      3. For New principals, enter the connector service account email for your deployment region from the table below.
      4. For Role, choose Service Account Token Creator (roles/iam.serviceAccountTokenCreator).
      5. Select Save.
      Grant the role above to the connector for your region:
      RegionConnector Service Account
      USairt-vertex-connector-pepper@pairs-redteam-prd-fckx.iam.gserviceaccount.com
      EUairt-vertex-conn-peppermint@pairs-redteam-prd-wrk-eusup.iam.gserviceaccount.com
      Singaporeairt-vertex-connector-pandan@pairs-redteam-prd-wrk-sgpdb.iam.gserviceaccount.com
      Japanairt-vertex-connector-perilla@pairs-redteam-prd-wrk-jpndb.iam.gserviceaccount.com

    © 2026 Palo Alto Networks, Inc. All rights reserved.