How to use the Data Boundary Framework Navigator agent skill

What is an agent skill, and what does this one do?

An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This skill, named assuredworkloads-frameworks-navigator, makes the agent act as a compliance analyst for Google Cloud Assured Workloads.

Given a description of your data residency or regulatory needs, the agent matches them to built-in Data Boundary Frameworks and cloud controls, scores how well each matches, and recommends which to apply. It prefers built-in options over custom ones. It uses gcloud commands and bundled Python scripts to read the framework catalog and produce a structured report.

• Maps natural-language workload requirements to Data Boundary Frameworks and cloud controls.
• Browses built-in Data Boundary frameworks.
• Validates matched resources and identifies major requirement gaps.
• Recommends built-in frameworks first; custom frameworks only when built-ins cannot cover a requirement.

Install the skill from the ZIP

Download the ZIP of the skill from this page and unzip it. Place the resulting skill folder in one of these locations, depending on how you want to use it:

• Personal use across projects: unzip into ~/.claude/skills/
• Single project: unzip into the project's .claude/skills/ folder
• Claude apps: upload the skill under Settings → Capabilities → Skills

Meet the requirements before you run it

The skill checks its own prerequisites, but you need the underlying tools and access in place. The skill is designed to run gcloud commands and Python scripts, so these must be available on your machine.

• Google Cloud CLI (gcloud), with the compliance-manager commands available.
• A Google Cloud project with billing enabled and the Cloud Security Compliance API enabled (the skill runs gcloud services enable cloudsecuritycompliance.googleapis.com).
• Authentication through gcloud auth login.
• IAM role roles/assuredworkloads.reader or roles/assuredworkloads.admin.
• Python 3 to run the bundled analyzer and loader scripts.

Trigger the skill with a natural request

You do not need a special command. Describe your workload and its requirements in plain language. The skill is meant to activate when you ask it to map workload requirements to Assured Workloads or Data Boundary Frameworks, browse built-in frameworks, or find major requirement gaps.

Include the details that matter for your decision: where the data must stay, which regulation applies, and what kind of workload it is. The agent will classify requirements as major or minor and map them accordingly.

• "I need to host customer data in the EU for a workload that must meet data residency rules. Which built-in Data Boundary Framework fits?"
• "Browse the built-in Data Boundary frameworks and tell me which ones cover data residency."
• "Which major requirements for my healthcare workload are not met by the top framework match?"

Read the output

The agent gives a rationale for its recommendation and a table of matching scores by priority dimension. Frameworks are listed from best match to weakest. It does not list the underlying cloud controls of a framework unless you ask for them.

Recommended built-in frameworks are shown whatever their match percentage. Custom frameworks or cloud controls are suggested only when the overall match is below 80% or when additional cloud controls have no common built-in framework. In those cases the skill hands off to the assuredworkloads-frameworks-author skill.

Safety notes: scripts and network access

This skill runs scripts and uses the network. It executes bundled Python scripts (scripts/db_output_match_analyzer.py and scripts/db_resources_loader.py) and calls Google Cloud through gcloud. Review the skill files before you install them, and run it only in a project where you are comfortable making these calls.

Every gcloud command the skill runs is tagged for usage attribution through the CLOUDSDK_METRICS_REQUEST_ATTRIBUTION variable. The tag identifies only the skill and its version and carries no user data. The skill does not change your global gcloud configuration for this purpose.

• The skill is scoped to Data Boundary matching only.
• It does not perform automated Terraform deployment without a human choosing the framework.
• Its output is analyst guidance and should be reviewed by qualified compliance staff. It is not a legal certification.

Tips for better results

Give the agent specific requirements rather than a general goal. Name the regulation, the data type and the regions involved where you know them. The more precise the input, the more precise the match.

For general compliance posture checks outside Data Boundary frameworks, the skill says to leave that work to Compliance Manager.

• State whether each requirement is mandatory or a preference.
• Ask for the underlying cloud controls only when you need them, since the skill omits them by default.
• Keep your gcloud project and account set to the environment you intend to assess.