How to use the Assured Workloads Framework Author agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder of instructions and optional scripts that an AI agent loads when a task matches the skill's description. This skill covers Assured Workloads, a Google Cloud service that helps organisations meet data residency and regulatory rules.

When built-in controls cannot meet a requirement, the agent drafts new custom cloud controls (CEL rules that check cloud resource configurations) and bundles them into a customized framework. It first checks whether existing built-in frameworks already cover the need. It then presents the drafted field values so you can deploy them through the Google Cloud console or commands.

• Checks whether built-in frameworks already satisfy the requirement before creating anything.
• Drafts the name, description, display name, resource type and CEL rule for each custom cloud control.
• Keeps the built-in framework unchanged and places new controls in a separate customized framework.
• Hands read-only lookups, such as listing existing frameworks, to the companion navigator skill.

Install the skill

Download the ZIP from the skill's page on this site and unzip it. Then put the folder in one of these locations, depending on whether you want it for all projects or one project:

• For all your projects: unzip into ~/.claude/skills/
• For a single project: unzip into the project's .claude/skills/ folder
• Alternatively, in the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.

Check the requirements before you start

The skill performs real provisioning when you approve it, so the environment must be ready. The agent checks most of these silently, but you need to supply them.

• Google Cloud SDK (gcloud) installed, with an active login (gcloud auth login if missing).
• An active Google Cloud project with billing enabled.
• The Compliance API enabled on the project.
• The roles/assuredworkloads.admin IAM role.
• The companion skill assuredworkloads-frameworks-navigator, which the author skill uses for read operations and its scripts.

Trigger the skill with natural requests

You do not need special syntax. Describe the control or framework you need in plain language. The skill is meant for requirements that built-in controls cannot satisfy, such as a custom data boundary rule.

Requests that suit this skill are about creating or synthesising controls or frameworks. Requests that only browse or map existing built-in frameworks are handled by the navigator skill instead.

• "Draft a custom cloud control that flags storage buckets created outside our approved region."
• "Our data boundary needs a rule the built-in frameworks don't cover. Can you author a customized framework for it?"
• "Check whether an existing Assured Workloads framework already covers our data residency requirement, then draft anything that's missing."

Choose how the drafted controls are deployed

After drafting, the agent offers two options. Option 1 gives you a copy-paste summary of every field plus the console link https://console.cloud.google.com/compliance/configure/frameworks and navigation instructions. Option 2 lets the agent create the frameworks in place, but only if you explicitly approve it. For Option 2 the agent asks for authentication and fetches your organization ID, for example with gcloud projects get-ancestors PROJECT_ID, before running create commands.

• Option 1: review the fields and paste them into the Google Cloud console yourself.
• Option 2: approve in-place creation, complete authentication, and let the agent run the gcloud commands.

Understand the safety notes

This skill runs scripts and uses the network. It calls gcloud and Google Cloud APIs when you approve in-place creation, and its read operations rely on the companion navigator skill's scripts. Every gcloud command is tagged for usage attribution by setting an environment variable inline on the command, and the tag carries no user data.

Custom CEL rules can only be detective. The API rejects preventive action types, so the agent will not create preventive custom rules. Treat all drafted output as configuration that still needs expert review. It is not a legal or audit sign-off.

Tips for better results

Give the agent the regulation or data boundary in concrete terms, such as which resource types and locations matter. Ask for a check of built-in coverage first if you are unsure whether a custom control is needed.

• Name the resource types and regions involved; the agent references Supported Resource Types for the CAIS schema.
• Expect the agent to refuse custom controls for standard regimes such as FedRAMP, HIPAA or PCI-DSS, because built-in controls already satisfy them.
• Review the drafted CEL rule against your own resource configurations before deploying it.