Google’s identity and directory platform providing SSO, MFA, and context-aware access policies for organizations running Google Workspace and Google Cloud infrastructure.
Google Cloud Identity governs human authentication across Workspace, GCP services, and federated SaaS applications, with context-aware access policies that add device and location enforcement to that human identity layer. The gap appears at workloads: Google Cloud Identity does not govern the services, agents, and pipelines running inside GCP, which rely on service accounts with static keys or GCP-native workload identity, and the access they need to reach external APIs, third-party SaaS, and non-Google services falls outside the scope of what Google Cloud Identity was designed to handle. Aembit connects to Google Cloud Identity for Aembit administrator sign-in, and enables blended identity in agentic AI scenarios where Google-authenticated users and AI agent workload identities are combined into a single access decision.
Aembit does not replace Google Cloud Identity. Google Cloud Identity governs human identity and application access, a problem Aembit was not designed to solve.
Aembit integrates with Google Cloud Identity via OIDC 1.0. Organizations that already have Google Cloud Identity deployed get:
– Administrator single sign-on to the Aembit platform using Google credentials, so security and platform teams authenticate to Aembit using the same identity they use across Workspace and GCP. Aembit supports OIDC for this integration, with automatic user creation mapped from Google group claims to Aembit roles.
– Blended identity for agentic AI scenarios. When an AI agent acts on behalf of a Google-authenticated user, Aembit redirects the user to Google for authentication, captures the resulting OIDC claims (email, groups, hd for domain, custom attributes), and combines them with the AI agent’s workload identity into a single access decision. This allows policies that account for both who the Google user is and what agent workload is acting on their behalf — something Google Cloud Identity’s context-aware access policies cannot enforce for agent workloads acting autonomously.
– Per-user credential isolation in agentic workflows. Each user’s AI agent session receives credentials scoped to their Google-attested identity, so users can be revoked independently without affecting others.
– A combined audit record covering both the Google-authenticated human identity and Aembit’s workload access log, providing the dual-attribution evidence that compliance frameworks require for AI agent access.
Note:
Aembit also connects to GCP infrastructure through its GCP Identity Token trust provider and Google Workload Identity Federation credential provider. Those integrations are distinct from the Cloud Identity IdP integration described here and are relevant for GCP-hosted workloads authenticating to downstream Google and non-Google services.
Resources:
Integration guide
Setup (OIDC)
Blended identity
GCP Workload Identity Federation (for GCP workloads)
Google Cloud Identity and Aembit address different layers of identity in Google-centric enterprise environments.
Google Cloud Identity governs human identity: it authenticates employees across Google Workspace (Gmail, Drive, Meet, and so on), enforces context-aware access policies based on device compliance and network location, and manages directory and group membership for GCP IAM bindings. For organizations that run primarily on Google infrastructure, it provides a human identity model across both productivity tools and cloud services.
The workload layer is a different problem. GCP workloads running in GKE or Compute Engine can use Workload Identity Federation to authenticate to GCP services natively. The gap appears outside that boundary: third-party SaaS APIs, databases not running on GCP, external AI services, and on-premises systems all require a credential delivery mechanism that GCP-native workload identity does not provide. Aembit fills that gap, and also adds conditional access enforcement (posture checks, time-of-day, geographic context) on top of workload access that GCP-native mechanisms do not offer.
The two tools operate in parallel. Google Cloud Identity continues to govern human access across Workspace and GCP. Aembit governs which GCP workloads, agents, and pipelines can reach services beyond the GCP boundary, and handles the blended identity model that agentic AI scenarios require.
Get started in minutes, with no sales calls required. Our free- forever tier is just a click away.
