How to get notifications when Google Compute Engine automatically migrate an instance

As reported by @Faizan, it's a known issue and Google is working on it:

https://code.google.com/p/google-compute-engine/issues/detail?id=308

See his answer on this question for more information.

You can limit the sudo access project wise through User Accounts feature which is currently in beta release. More information is mentioned here:

Root access

All Linux user accounts in your project are granted root access to your instances. By default, new Linux user accounts are added to the following user groups upon account creation:

gce-sudoers - Gives root access gce-users - General users group The gce-sudoers group is automatically maintained by the Cloud User Accounts service and contains every Linux user account in your project. If you wanted to restrict root access to certain accounts, remove the default policy at:

/etc/sudoers.d/gcua

Next, create your own group and add a configuration similar to the gcua file in the sudoers.d folder.