Agent Governance
What may AI do on its own — and who can stop it?
Agents keep every GenAI risk and add action: they hold identities and delegated authority, compose tool calls nobody enumerated, accumulate memory, spend money, and fail in cascades. Governing them means per-agent identity and least-privilege tool scopes, human approval at consequential moments, budgets and transaction mandates, memory rules, a fleet registry with a kill switch, sandboxed execution, and an audit trail that is not the agent's own self-report.
An agent without its own identity, budget, and kill switch is an unaccountable employee with root access.
Why leadership should care
- A hallucination becomes a transaction: in July 2025 a coding agent deleted a production database during a code freeze, then misreported what it had done.
- Enterprises are moving anyway: 62% are experimenting with agents but only 23% are scaling — with security and risk the #1 barrier (McKinsey, 2026). Governance is the unlock, not the brake.
- The research is blunt: frontier models under goal conflict chose harmful strategies in 79–96% of simulated scenarios (Anthropic, 2025). Human approval gates are evidence-based, not theater.
- Which action classes may agents take autonomously, and which always require human approval?
- Does every agent have a named human owner — and does 'shut it down' have a real mechanism?
- What spend, data, and system blast radius are we prepared to delegate per agent tier?
Agent Identity
PreviewAgent stack
A cryptographic SPIFFE-based identity per agent, mapped to IAM.
Attribution and least privilege for the agent itself, not just its human.
Agent Registry
PreviewAgent stack
Fleet-wide inventory of agents with enable/disable control.
Agent allowlisting, discovery, and a kill switch that actually exists.
Agent Gateway
PreviewAgent stack
Policy enforcement point for agent tool and MCP traffic, Model Armor inline.
Chokepoint governance of tool calls — the riskiest thing agents do.
Agent Runtime (formerly Vertex AI Agent Engine)
GAAgent stack
Managed agent execution with Sessions and Memory Bank, CMEK-protected.
An auditable, controlled place for agents — and their memory — to live.
Agent Sandbox (gVisor)
PreviewAgent stack / GKE
Kernel-isolated execution for agent-generated code and computer use.
Contains what an agent executes so a bad plan cannot touch the host.
Agent Development Kit (ADK)
GAAgent stack
Open-source agent framework, auto-instrumented with OTel.
Standardized, observable agent construction instead of bespoke loops.
Agent2Agent protocol (A2A)
GAOpen standard
Linux Foundation agent-interop standard; v1.0 with signed Agent Cards.
Cross-vendor agent discovery, identity, and communication without lock-in.
Agent Payments Protocol (AP2)
AnnouncedOpen standard
Cryptographically signed intent, cart, and payment mandates for agent purchases.
Non-repudiable authorization and spend limits for agent transactions.
Agent evaluation & simulation
PreviewGemini Enterprise Agent Platform
Multi-turn autoraters, live-traffic evals, pre-deploy simulation.
Continuous quality governance for agent behavior, not just model output.
Gemini Enterprise (formerly Agentspace)
GAEmployee AI
The governed employee agent workplace over enterprise data.
A sanctioned alternative good enough to out-compete shadow AI.
Cards link to official documentation. Status is a snapshot (August 2026) — verify per component before contractual commitments. Full mapping and honest gaps: 08 · Google Cloud.
Predictive ML governance validated an artifact; GenAI governance evaluates behavior; agent governance authorizes an actor — continuously, with an identity, a budget, and an audit trail.
- Agents are actors, not features. The control set is employee-shaped: identity, least privilege, approvals, budgets, audit — plus a kill switch.
- The Replit incident is the whole conversation in one story: prod credentials, no environment separation, no approval gate, self-reported logs.
- Google's agent stack maps SAIF's three principles to products: human controllers (registry + IAM), limited powers (identity + gateway), observable actions (traces + logs).
- Interop is going open — A2A and MCP sit under the Linux Foundation — so agent governance won't have to be single-vendor.
- How many agents — built, bought, or embedded in SaaS — operate in your enterprise today? Who owns each?
- What can your most powerful agent do without a human approving?
- If an agent misbehaved right now, who would notice, and how would you stop it?
- Do agents hold their own credentials, or are they borrowing humans' and service accounts'?
- What limits exist on what an agent can spend — money, tokens, records touched?