IAM and service accounts - Harmonia

Google Cloud IAM separates machine responsibilities. Harmonia does not deploy the web app, agent worker, queue push, and scheduled ticks under one shared identity.

How Harmonia uses it

Identity	Main permissions
`harmonia-web`	Web Firestore access, Pub/Sub publication, scoped storage signing/access, required secrets, tracing
`harmonia-agent`	Worker Firestore/internal access, model prediction, storage, required secrets, tracing
`harmonia-pubsub-push`	Invoke the private worker with the configured audience
`harmonia-scheduler`	Invoke only scheduled worker endpoints

The Pub/Sub service agent receives token-creator authority only where required for OIDC. Runtime accounts receive access to named secrets instead of project-wide plaintext configuration.

Security and authority

IAM permits infrastructure calls; it does not replace Harmonia’s tenant, policy, approval, digest, budget, claim, or verification checks. Application code still evaluates every consequential operation.

Failure behavior

Missing roles produce visible provider or authorization failures. Deployment scripts do not broaden permissions dynamically to make a failed action appear successful.

Evidence status

Setup scripts define the intended least-privilege topology. Production claims require authenticated IAM policy inspection for the deployed project.

Relevant files

infra/setup.sh
infra/deploy.sh
src/lib/internalAuth.ts
docs/deployment.mdx

Last modified on August 28, 2026