feat: Support protected write in BigQuery execute_sql tool

This change adds a new enum value which the agent builder can pass in the `BigQueryToolConfig` to allow limited writes to the `execute_sql` tool. PiperOrigin-RevId: 776661744

Author: google-genai-bot

contributing/samples/bigquery/agent.py

@@ -26,7 +26,11 @@
 CREDENTIALS_TYPE = AuthCredentialTypes.OAUTH2
 
 
-# Define BigQuery tool config
+# Define BigQuery tool config with write mode set to allowed. Note that this is
+# only to demonstrate the full capability of the BigQuery tools. In production
+# you may want to change to BLOCKED (default write mode, effectively makes the
+# tool read-only) or PROTECTED (only allows writes in the anonymous dataset of a
+# BigQuery session) write mode.
 tool_config = BigQueryToolConfig(write_mode=WriteMode.ALLOWED)
 
 if CREDENTIALS_TYPE == AuthCredentialTypes.OAUTH2:

src/google/adk/tools/bigquery/config.py

@@ -26,10 +26,20 @@ class WriteMode(Enum):
 
  BLOCKED = 'blocked'
  """No write operations are allowed.
- 
+
  This mode implies that only read (i.e. SELECT query) operations are allowed.
  """
 
+ PROTECTED = 'protected'
+ """Only protected write operations are allowed in a BigQuery session.
+
+ In this mode write operations in the anonymous dataset of a BigQuery session
+ are allowed. For example, a temporaray table can be created, manipulated and
+ deleted in the anonymous dataset during Agent interaction, while protecting
+ permanent tables from being modified or deleted. To learn more about BigQuery
+ sessions, see https://cloud.google.com/bigquery/docs/sessions-intro.
+ """
+
  ALLOWED = 'allowed'
  """All write operations are allowed."""