Google’s Data Agent Kit makes notebook execution opt-in—but scheduling can cross the default project boundary

Google Cloud’s Data Agent Kit does not enable notebook code execution merely because the extension is installed. Its configuration guide says operators must turn on the google.datacloud.executeCellToolForNotebookMCP IDE setting before an agent can use the Notebook MCP execute_cell tool. The same guide says generated notebooks can include a commented-out command to install or upgrade BigQuery DataFrames, leaving that environment-changing step visible rather than automatic. (Google Cloud configuration guide)

That is a useful control boundary: allowing an agent to generate a notebook and allowing it to execute notebook cells are separate decisions. Teams deploying the kit should therefore treat the IDE setting as an execution grant, not a convenience toggle, and manage it with the same care as any other tool that can run code in a user’s working environment. Google separately warns that coding agents commonly operate with authority delegated by the controlling user and can mistake warehouse or storage content for instructions. (Google Cloud prompt-injection guidance)

The scheduler has its own destination

The less obvious configuration detail is in Data Agent Kit’s Scheduler setup. Google says the Scheduler project and region do not need to match the project and region selected under the extension’s Common settings. Operators then select a Managed Service for Apache Airflow environment for workflows. (Google Cloud configuration guide)

That flexibility is practical for centralized orchestration, but it also means reviewing the default project displayed in the IDE is not enough to determine where an agent-assisted workflow will run. Deployment checks should capture the Common project and region, the Scheduler project and region, and the selected Airflow environment as distinct configuration values. This is an operational recommendation derived from Google’s documented separation, not a claim that the kit bypasses IAM. The extension checks IAM roles and required APIs for selected services and lists missing permissions for administrators. (Google Cloud configuration guide)

A minimal rollout check

Before enabling notebook execution, a team should verify the identity behind the IDE session, the notebook kernel and installed dependencies, and whether the execute_cell setting is centrally governed or left to each workstation. Before enabling scheduled workflows, it should record both project/region pairs and the Airflow destination in the deployment review.

Google’s own security guidance recommends constrained environments such as Cloud Workstations without internet access or root privileges, and lists organization restrictions, principal access boundaries, VPC Service Controls and Model Armor as additional defenses against indirect prompt injection. (Google Cloud prompt-injection guidance)

The practical takeaway is that Data Agent Kit exposes two controls that deserve separate approval: the ability to execute code now, and the ability to schedule work somewhere else.