iam_create_service_account

What iam_create_service_account does on Mimi Seed

AI agents use iam_create_service_account to create or update resources in Mimi Seed, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mimi Seed environment.

Why iam_create_service_account is rated Medium

This tool creates new service accounts in Google Cloud/Firebase IAM, which is a reversible modification operation. While not immediately destructive, service account creation can grant elevated permissions and access to sensitive resources, making it a Write-category risk with high severity due to potential blast radius if an AI agent creates accounts with excessive permissions or for unauthorized use.

From the tool's definition Tool description indicates 'Create new service account' (translated from Korean: '새 서비스 계정 생성'). Service account creation is a write operation that modifies IAM configuration by adding new credentials and permissions.

The rule that runs iam_create_service_account safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Mimi Seed, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For iam_create_service_account, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "iam_create_service_account": {
      "limits": [
        {
          "counter": "iam_create_service_account_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about iam_create_service_account