Google Cloud, part of Alphabet Inc. (Nasdaq: GOOGL), has added folder-based membership, broader rule targets and guided remediation to VPC Service Controls, giving security teams a more scalable way to apply data perimeters across complex cloud estates. The changes address a practical obstacle for enterprises deploying autonomous agents and new workloads: policies that are secure enough to limit data movement can become difficult to maintain as projects multiply.
Google said the update is generally available at no additional cost. VPC Service Controls is designed to add a context-aware network perimeter around a Google Cloud deployment, including protection against data theft tied to compromised credentials, identity and access management misconfigurations and insider threats.
Folder Membership Makes the Resource Hierarchy a Security Boundary
Administrators can now add folders to a service perimeter. Projects and nested subfolders inside that folder inherit the policy, according to Google Cloud, and the membership updates when a project moves within the hierarchy. That changes the operating model from adding each project individually to attaching protection to an organizational unit that teams already govern.
For a large environment, the value is less manual policy upkeep and a more consistent baseline for new workloads. It also gives compliance teams a simpler point of verification: confirm that a resource belongs in the appropriate protected branch of the hierarchy. Dry-run mode now supports folder membership, allowing administrators to observe the effect of a hierarchy-wide perimeter on live traffic before enforcing it.
The company also expanded ingress and egress rules so they can refer directly to folders and organizations. A single hierarchy reference can represent the projects below it, which Google says can keep rules within attribute quotas while automatically extending access to future projects in that part of the organization.
Private Paths and Specific APIs Get More Precise Controls
VPC Service Controls now supports Private Service Connect endpoints for Google APIs as an ingress or egress-rule attribute. Enterprises using private paths can authorize access over a designated endpoint rather than broadly allow a source. Google also added service patterns in VPC accessible services, allowing administrators to permit only particular API URL patterns accessed through private virtual IP addresses.
Those controls are relevant where application teams need access to a narrowly defined service but security teams want to avoid opening a wider egress path. Google said organizations can also append organization-restriction headers to egress requests, limiting access to authorized domains and resources without managing an egress proxy.
Guided Remediation Targets the Access-Denial Trade-Off
The other operational change is Guided Violation Remediation in VPC Service Controls Violation Analyzer. When a legitimate request is blocked, Google said the tool evaluates the request against the applicable perimeter configuration and proposes a least-privilege change, such as an ingress rule, egress rule, access level or VPC accessible-services update. Administrators can validate the recommendation in dry-run mode before enforcement.
That is a more focused response than broadly opening a perimeter to restore application access, though enterprises will still need review processes for the proposed changes. The company says the feature can reduce resolution time from days to minutes; that is a vendor claim and will depend on an organization’s configuration and approval workflow.
The competitive shift is toward perimeters that track the organizational structure of a cloud environment rather than static, project-by-project exceptions. Legacy approaches often force teams to choose between restrictive controls that slow developers and broad allowances that weaken data protection. Google Cloud’s update aims to make the protected path easier to scale, particularly as autonomous agents increase the speed and volume of requests across enterprise projects.