Google Cloud's Identity and Access Management (IAM) is the primary service for implementing fine-grained access control. It allows organizations to manage authorization by defining "who" (identity) has "what access" (role) for "which resource." For generative AI resources, such as models in Vertex AI, IAM enables administrators to grant specific permissions like viewing, using, or managing models to specific users, groups, or service accounts, thereby providing the required granular control.

B. Secure-by-design infrastructure: This is a foundational principle of how Google Cloud is built, encompassing physical security and data encryption, not a specific tool for managing user access to AI models.

C. Security Command Center: This is a centralized security management and risk platform for threat detection and posture assessment, not for setting granular user permissions on resources.

D. Workload monitoring tools: These tools, like Cloud Monitoring, are for observing performance and operational health. They do not manage or enforce access control policies.

1. Google Cloud Documentation

"Overview of IAM": "Cloud Identity and Access Management (IAM) lets you grant granular access to specific Google Cloud resources and helps prevent access to other resources. IAM lets you adopt the security principle of least privilege

so you grant only the necessary access to your resources." (cloud.google.com/iam/docs/overview)

2. Google Cloud Documentation

"Vertex AI access control with IAM": "You can control access to Vertex AI resources by using Identity and Access Management (IAM). IAM lets you grant access to specific Google Cloud resources and prevents unwanted access to other resources... For example

you can grant a user the AI Platform Viewer (roles/aiplatform.viewer) role so the user can view Vertex AI resources in a project." (cloud.google.com/vertex-ai/docs/general/access-control)

3. Google Cloud Security Whitepaper

"Google Cloud security foundations guide": This guide describes the "secure-by-design" approach as a layered security strategy built into the infrastructure

from the physical data centers to the purpose-built security hardware. This confirms it is a design philosophy

not an access control service. (cloud.google.com/resources/google-cloud-security-foundations-guide

Section: "Secure-by-design infrastructure")