Quotas and limits

This document lists the quotas and system limits that apply to Policy Intelligence.

  • Quotas have default values, but you can typically request adjustments.
  • System limits are fixed values that can't be changed.

Google Cloud uses quotas to help ensure fairness and reducespikes in resource use and availability. A quota restricts how much of aGoogle Cloud resource your Google Cloud project can use. Quotasapply to a range of resource types, including hardware, software, and networkcomponents. For example, quotas can restrict the number of API calls to aservice, the number of load balancers used concurrently by your project, or thenumber of projects that you can create. Quotas protect the community ofGoogle Cloud users by preventing the overloading of services. Quotas alsohelp you to manage your own Google Cloud resources.

The Cloud Quotas system does the following:

In most cases, when you attempt to consume more of a resource than its quotaallows, the system blocks access to the resource, and the task thatyou're trying to perform fails.

Quotas generally apply at the Google Cloud projectlevel. Your use of a resource in one project doesn't affectyour available quota in another project. Within a Google Cloud project, quotasare shared across all applications and IP addresses.

For more information, see theCloud Quotas overview.

To adjust most quotas, use the Google Cloud console. For more information, seeRequest a quota adjustment.

There are alsosystem limits on Policy Intelligence resources. System limits can't be changed.

Policy Analyzer quotas

Cloud Asset Inventory enforces the rate of incoming requests based on the consumerproject. Default quotas are listed below:

QuotaValue
AnalyzeIamPolicy

100 per minute per consumer project

1,000 per day per consumer project

AnalyzeIamPolicyLongrunning

100 per minute per consumer project

1,000 per day per consumer project

You can use theAPIs and services quotas dashboardto view current quotas and usage for your project.

Policy Analyzer also limits the number of queries that you can makeif you don't have anorganization-level activation of the Premium or Enterprisetier ofSecurity Command Center.

QuotaValue
Analysis queries per organization per day120

1 This quota only applies for organizations that don't have anorganization-level activation of the Premium or Enterprise tier ofSecurity Command Center.

For more details, seeBilling questions.

Policy Analyzer limits

Policy Analyzer limits group expansion within the group membershipsand resource expansion within the resource hierarchy to the following values.

LimitValue
AnalyzeIamPolicy1,000 per group
AnalyzeIamPolicy1,000 per resource
AnalyzeIamPolicyLongrunning100,000 per resource

Recommendations limits

The following limits apply to IAM recommendations:

LimitValue
Number ofrecommendations per day to add a custom role to an organization15
Number ofrecommendations per day to add a custom role to a project5
Number of custom roles in an organization that prevents recommendations to create new custom roles1100
Number of custom roles in a project that prevents recommendations to create new custom roles225

1 If your organization contains more than100 custom roles, you willcontinue to receive role recommendations from Recommender.However, none of the recommendations will suggest that youcreate a new customrole.

2 If your project contains more than25 custom roles, you willcontinue to receive role recommendations from Recommender.However, none of the recommendations for that project will suggest that youcreate a new custom role.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.