> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useharmonia.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM and service accounts

> How Harmonia separates web, worker, Pub/Sub, and Scheduler identities with least privilege.

Google Cloud IAM separates machine responsibilities. Harmonia does not deploy the web app, agent worker, queue push, and scheduled ticks under one shared identity.

## How Harmonia uses it

| Identity               | Main permissions                                                                                    |
| ---------------------- | --------------------------------------------------------------------------------------------------- |
| `harmonia-web`         | Web Firestore access, Pub/Sub publication, scoped storage signing/access, required secrets, tracing |
| `harmonia-agent`       | Worker Firestore/internal access, model prediction, storage, required secrets, tracing              |
| `harmonia-pubsub-push` | Invoke the private worker with the configured audience                                              |
| `harmonia-scheduler`   | Invoke only scheduled worker endpoints                                                              |

The Pub/Sub service agent receives token-creator authority only where required for OIDC. Runtime accounts receive access to named secrets instead of project-wide plaintext configuration.

## Security and authority

IAM permits infrastructure calls; it does not replace Harmonia's tenant, policy, approval, digest, budget, claim, or verification checks. Application code still evaluates every consequential operation.

## Failure behavior

Missing roles produce visible provider or authorization failures. Deployment scripts do not broaden permissions dynamically to make a failed action appear successful.

## Evidence status

Setup scripts define the intended least-privilege topology. Production claims require authenticated IAM policy inspection for the deployed project.

## Relevant files

* `infra/setup.sh`
* `infra/deploy.sh`
* `src/lib/internalAuth.ts`
* `docs/deployment.mdx`