FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Adopting sanitize-only Model Armor IAM
Removing an unsupported condition and establishing the single-permission boundary
Purpose
The source baseline needed IAM the runtime could actually evaluate while keeping Model Armor use limited to sanitizing user prompts.
Implementation
The runtime service account's custom role now contains only one sanitization permission and no unsupported resource.name condition.
The Terraform module, module documentation, integrated specification, and static audit were aligned with the same contract, including checks for both the condition and permission set.
Rendering diagram…
What was confirmed
Verification results
Terraform formatting, validation, GCP verification, specification auditing, and the diff check passed.
Across the adopted five-file state, the permission set and absence of the unsupported condition agreed.
Verification through a real provider canary occurred after the cutoff and is not included.
Basis for completion
This scope ended when the single sanitize-only permission and supported IAM form were adopted across source, documentation, and audits.