Google outlines a zero-trust security architecture for production AI agents

Google shifts agent security outside the prompt

Google's Developer Blog published a production-oriented security pattern for autonomous AI agents built with its Agent Development Kit (ADK). The central point is that system prompts should not be treated as hard security boundaries when an agent can mutate real production state. A prompt-injected agent may still attempt an unauthorized database write, secret exfiltration or unsafe code execution, so Google recommends enforcing controls outside the model context.

Three hard security layers

The architecture described by Google combines three independent controls. First, state-changing writes can be cryptographically signed with per-agent keys, with production keys backed by Cloud KMS and hardware security modules so the private material does not live inside application containers. Second, dynamically generated code can run inside a gVisor sandbox with network egress disabled, root capabilities removed and strict CPU, memory and timeout limits. Third, a deterministic semantic gateway can inspect model inputs and tool outputs against explicit business rules before sensitive actions are allowed.

Why this matters for agent developers

The guidance is useful because it treats agent security as an infrastructure and software-contract problem rather than a prompt-engineering problem. Google also recommends regression-testing the gateway rules in CI/CD so model migrations or prompt changes do not silently weaken controls. The accompanying reference implementation demonstrates these patterns on an autonomous support and refund agent.

For teams deploying coding agents, customer-support agents, finance workflows or other systems with write access, the practical lesson is to assume the model can be manipulated and to constrain what the surrounding system will actually permit. The official Google Developers article and open-source reference implementation should be reviewed directly before adapting the pattern to a production environment.