Enterprise Security in the Agentic AI Era

Google Cloud Agentic Security Profile

20 min read

Google Cloud Agentic Security Profile

This page reads the six-plane reference architecture and the nine-domain CMM against Google Cloud alone, plane by plane and domain by domain, and names the planes where Google ships no native control. It answers a closure condition the May regulated-FI stress test left open: “a single-stack reading of the RA per major platform (Microsoft-only, AWS-only, GCP-only) that names where the platform has no native control and an off-stack component is unavoidable” (Agentic AI CMM: Regulated-FI Stress Test). The Microsoft-only and AWS-only readings stay open. The worked example is the productivity-assistant shape, an assistant holding tools over a whole tenant’s mail, files and calendar, running on Gemini for Google Workspace. Product status is a 2026-09-16 documentation snapshot, and the pages cited here name Google’s generative-AI surface Gemini Enterprise Agent Platform, which Google previously called Vertex AI.

The deployment shape

AttributeThis profile
HostGemini in the Workspace side panels and the Gemini app with Workspace extensions; agents built in-house run on Agent Runtime behind Agent Gateway
ModelGemini, served by Gemini Enterprise Agent Platform
KnowledgeThe employee’s own Gmail, Drive, Docs, Calendar and Chat — per-user reach across the whole tenant corpus
UsersEvery employee, through their own account
ToolsRead, write and share across mail, files and calendar
LicensingGoogle Workspace with Gemini; Cloud Identity federated to the organization’s provider

The assistant reads private data, ingests untrusted content on every summarization of an inbox or a calendar, and writes and shares, so all three legs of the lethal trifecta are present. The vault’s other deployment-shape profile, the Azure RAG chatbot profile, covers a closed-corpus bot whose broken trifecta lowers the required level across five domains; that reduction does not transfer here, and no plane falls out of scope.

The control profile per plane and domain

Plane / DomainEvidenceable → neededGoogle controlStatus as documentedThe one thing that matters
Identity (D2)L2 → L3Agent Identity: a SPIFFE ID per agent, a 24-hour X.509 certificate, and access tokens bound to it1No launch stage stated1An agent on Agent Runtime gets a first-class principal; the Workspace assistant acts as the employee and has none
Control (D3)L1 to L2 → L3 to L4IAM Unified Access Policies at Agent Gateway, evaluated by Identity-Aware Proxy, with CEL conditions and a DRY_RUN mode before ENFORCE2No launch stage stated2A declarative decision point exists and excludes the egress perimeter (below)
Runtime (D4)L2 → L3 to L4Model Armor templates or floor settings; the check grounding API for a 0-to-1 support score at inference time34GA per named feature and integration; none stated for the core screening service35Model Armor documents no Gmail, Docs or Drive integration, so this shape’s screening is the vendor’s own
Egress (D5)L1 to L2 → L3VPC Service Controls perimeters; Model Armor inline at Agent Gateway, Apigee or a Service Extension; Private Service Connect to the Model Armor API67GA for the Model Armor, Agent Runtime, Secure Web Proxy and Sensitive Data Protection integrations6The customer holds no in-path position between a Workspace assistant and its tools
Data (D6)L2, L3 in part → L3 to L4Sensitive Data Protection inside Model Armor at no extra charge; CMEK on Agent Platform datasets, models and feature stores; Workspace data regions389SDP integration GA; DSPM states no launch stage and shuts down 2027-02-0168No answer-time entitlement control is documented, which is the load-bearing absence
Observability (D7)L2 → L3OpenTelemetry GenAI semantic conventions into Cloud Trace and Application Monitoring; Google SecOps; Agent Platform Threat Detection1011OTel path states no launch stage; Agent Platform Threat Detection Preview1011The threat detector reads host and control-plane compromise, and grades no agent behaviour
Governance (D1)L3 → L3 to L4Per-organizational-unit enablement in the Admin console; the AI control centre and its usage review1213Not graded — administrative console features”Per agent type” has no referent when the agent population equals the headcount
Supply chain (D8)L2 → L2 to L3Consumer-grade only: the vendor’s model card is this shape’s bill of materials; Assured Workloads bounds which products are in scope1415Control packages documented; product membership per package15Producer-grade AI-BOM does not apply, and package membership decides what a regulated workload may use
Operations (D9)L2 to L3 → L3Google SecOps SIEM and SOAR for the runbook, both in scope for Canada Protected B; the Admin console usage review1513SecOps in the Protected B product list15The involvement measure D9 asks for is a vendor-side override rate the customer cannot read

The first column carries the September scoring of this shape in CMM Stress Test: Canadian FI on Google Cloud, band for band, and this page re-scores nothing. That review also records that neither the CMM’s shape table nor the reference architecture’s carries a row for a productivity assistant, so the model sets no target of its own; the row the review proposes for the missing shape reads L3 across all nine domains with L4 in D6 and D9.

The four controls the customer holds

Google documents four controls the customer holds, and the list ends there: per-organizational-unit enablement, data-loss-prevention rules bounding what the assistant reaches, an administrative control centre with a usage review, and a stated training restriction over customer data.12161317 The vendor’s own account describes four layers against indirect prompt injection — visible-content-only input, structural hierarchy in the prompt, deterministic orchestration sandboxing that restricts downstream capability by data origin, and output hardening that scrubs image tags and ungrounded links (Securing Workspace GenAI at Google). Three of those four are unevidenceable from the customer’s side, which holds D3, D4 and D5 at L1 to L2 for this shape. The September stress test checked twelve control absences in the vault’s own coverage of this shape and confirmed all twelve against a strong threat record, the sharpest being that Model Armor is documented against no Workspace traffic.

Planes with no Google-native control

On three planes Google ships an instrument that stops short of what the plane requires, and on each of the three the shortfall is in the control rather than in its maturity. Google SAIF: Secure AI Framework closes none of the three, because it names control categories without specifying controls, thresholds or test procedures.

Answer-time entitlement enforcement

Google documents permission inheritance and one wholesale admin lever, and nothing between them. “Gemini has the same access to Workspace data as you do”, and an administrator can restrict access to Gemini entirely or to some or all Workspace data.18 Two narrowings exist and are incidental to their own features: a Drive file whose owner blocks download, copy and print stays out of reach, and delegated Gmail access does not carry over.18 That page documents no control that narrows an answer at the time the answer is composed, which is the Data plane’s load-bearing requirement and the control the Azure profile meets with Entra-authenticated per-user trimming, with Restricted SharePoint Search as its stopgap. Oversharing Controls for AI Search owns the failure mode, and the assistant surfaces it as inference exposure: an answer composed from files the employee may open and never would.

Google Cloud DSPM does not close the gap. It lists supported asset types per control: BigQuery datasets and tables, Cloud Storage buckets, and Agent Platform models, datasets, feature stores and metadata stores, with Cloud Storage objects added at Preview. Drive does not appear on the page. The page states no launch stage of its own, three of its controls carry Preview markers, and the service shuts down on 2027-02-01.8 A buyer who needs answer-time narrowing over Workspace content buys it off-stack or accepts corpus permissions as the only control.

Runtime screening of Workspace traffic

Model Armor names six supported integrations — Agent Gateway, Apigee, Gemini Enterprise, Google and Google Cloud MCP servers, Service Extensions, and Gemini Enterprise Agent Platform — and only the Gemini Enterprise integration screens documents, while every other integration scans text.7 Gmail, Google Docs, Google Drive and Google Workspace appear zero times on both the overview and the integrations page.37 An organization can therefore screen an agent it builds and cannot screen the assistant its whole workforce uses, which is the shape that carries the trifecta.

Agent behavioral drift

Google’s agent-observability guidance names drift as a risk — “AI agents can drift, hallucinate, and regress silently” — and documents no drift detector, anomaly rule or baseline to act on it.19 Agent Platform Threat Detection detects the execution of malicious binaries or scripts, container escapes, reverse shells and attack tools in the agent’s environment, plus control-plane activity from Event Threat Detection, and it carries a page-level Preview banner.11 Those detectors read host and control-plane compromise, and the page names data exfiltration attempts, excessive permission denials and suspicious token generation among the control-plane threats.11 None of them grades agent behaviour, so an agent talked into misusing the access it legitimately holds registers only where its actions surface as one of those events, and never as a departure from how that agent normally behaves.

The agent decision point and the egress perimeter do not compose

IAM Unified Access Policies adjudicates agent-to-resource calls declaratively: policies bind to the project holding the Agent Gateway instances, each rule carries both an allow effect and a deny effect, conditions are written in CEL, a Principal Access Boundary can be set on the agent identity, and DRY_RUN logs disallowed agentic communications before ENFORCE blocks them.2 The page opens with its own limit: “This feature does not support VPC Service Controls.”2 From the other side, Agent Gateway does not appear on the VPC Service Controls supported-products page, while Model Armor, Agent Runtime, Secure Web Proxy and Sensitive Data Protection each carry a GA integration there.6

A single-stack buyer picks one. Adjudicating agent-to-resource calls at the gateway puts the decision point outside the service perimeter that protects the data plane around it; drawing the perimeter first leaves the agent-to-agent and agent-to-MCP paths to IAM allow and deny policies without the gateway’s rule model. The RA’s Control and Egress planes assume both controls run together, and on this platform they do not.

That choice exists only where the customer runs the agent. The Workspace assistant offers neither option, because the assistant, the tools it calls and the path between them all sit inside the vendor, so no perimeter, proxy or gateway the customer buys can take a position in that path. The closure condition this page answers asks where the platform ships no native control and an off-stack component is unavoidable, and on the Egress plane for this shape the answer runs the other way: the September stress test holds D5 at L1 to L2 and records the domain among those the bank cannot remediate.

The Canadian Agent Platform deployment spans two regions

Service coverage across the two regions

A Canadian requirement reaches the Agent Platform half of this deployment and stops at the Workspace half. Workspace data regions offer the United States or Europe, so the whole-tenant assistant has no Canadian option at all, and what follows reads the agents an organization builds on Agent Runtime behind Agent Gateway.9

Google Cloud operates two Canadian regions, Montréal and Toronto, and three separate things are located per region without coinciding.20 Each row below names the page that governs its claim, because Google’s own pages disagree about what Toronto carries.

What is locatedPage that governs the claimMontréal northamerica-northeast1Toronto northamerica-northeast2
Gemini model servingDeployments and endpoints21ListedNot listed
Agent runtime and Agent GatewayAgent locations20v1 GAv1 GA
Model ArmorFeature availability by region22Not listedListed, limited support

So the guardrail sits in Toronto beside the agent runtime it screens, and the model answering that agent is served from Montréal or from outside Canada. The split is a property of the platform’s coverage rather than a misconfiguration a buyer can tidy away, and a Canadian Agent Platform deployment holds two regions from the first day.

Seven of the twenty-seven Google-model rows on the residency table carry a Canada (northamerica-northeast1) commitment: Gemini 3.5 Flash, Gemini 2.5 Flash at 128k and 1M, Gemini 2.5 Pro at 64k and 1M, and the two text-embedding models. No 3.x flagship above 3.5 Flash carries one, and neither does any tuning row.23 Partner models sit on a separate table with no Canada column at all, so the coding shape described in Securing Agentic Coding has no Canadian residency option to configure.23 Where ML processing happens follows the endpoint the caller uses,23 and the locations page states that endpoints guarantee neither data residency nor in-region ML processing.21

The guardrail trade

Toronto is a limited-support Model Armor region, and the reduction is in filters rather than in residency. A template with data-residency compliance enabled keeps the responsible-AI filters, Sensitive Data Protection, and prompt injection and jailbreak detection, and loses malicious URL detection, multi-language detection, CSAM support, image support and antivirus scanning, “because they rely on services that might process data outside the jurisdiction of your chosen Model Armor region”.22 That template’s residency row reads Yes / Yes / Yes for data at rest, in use and in transit.24

Floor settings on the Agent Platform integration restore every filter and weaken the residency guarantee: Canada’s floor-settings row reads Yes / No / No, and the page defines that No as “the data might be processed or transmitted outside of the jurisdiction”.24 At-rest residency survives either choice, so the trade is over processing and transit.

Malicious URL detection is the filter a residency-enforced Toronto template gives up over the exfiltration route this shape’s recorded attacks used. GeminiJack exfiltrated mail, calendar and document content through an auto-loading <img> tag in the rendered answer, and EchoLeak carried data out of another vendor’s assistant by routing an image request through an allowlisted first-party link-preview endpoint. Each exfiltration leg is an outbound fetch the client performs as it renders markup, and malicious URL detection is the Model Armor filter that reads the URLs in a response. Model Armor’s image screening does not sit on that route. It screens images supplied in prompts and responses by visual scanning and optical character recognition, so it inspects what an image carries and never a URL the client fetches.3 Google’s own pages then disagree about Toronto: the feature-availability table lists image support among the features a residency-enforced Toronto template loses, while the overview states that image screening is supported in the us and eu multi-regions only, which would leave that template no image screening to lose.223 EchoLeak also bounds the filter that does apply, because its egress URL belonged to the vendor’s own allowlisted service and a reputation check clears such a URL.

Workspace output hardening sits on that route, and it is not Model Armor. The vendor’s account of it names markdown scrubbing of image tags and link protocols, Safe Browsing filtering of every URL, and removal of ungrounded links the model produced without a source in its input (Securing Workspace GenAI at Google). No region gates that layer and no customer configures it: the September stress test grades D4 for this shape on the vendor’s four-layer architecture, sourced to a conference talk. A Canadian institution that enforces residency on the guardrail therefore gives up the response-side URL filter over the route indirect prompt injection against this shape has used, and what still covers that route is a vendor-side layer the institution cannot evidence. Floor settings restore the filter and accept processing outside the jurisdiction. Both horns are configurations, and the choice belongs in the third-party-risk file the Canadian regulated-finance crosswalk maps to OSFI Guideline B-10.

Assured Workloads coverage

Four Canadian control packages exist. Canada Data Boundary is free and Canada Data Boundary and Support, Data Boundary for Canada Protected B, and Data Boundary for Canada Controlled Goods Program are premium; each sets data-location controls for Canada-only regions, and the three premium packages add a support-access control: Canada Data Boundary and Support limits first-level and second-level support access to personnel legally eligible to work in Canada and physically located in Canada, and the Protected B and Controlled Goods packages require Canadian support personnel who have completed the matching screening.14 Model Armor is in scope for Canada Data Boundary and for Canada Data Boundary and Support, which carry 112 products each, and out of scope for Data Boundary for Canada Protected B, which carries 109.15 A Protected B workload therefore runs with no Assured Workloads coverage for the runtime-guardrail plane, while Google SecOps SIEM and SOAR, Cloud Logging, Apigee and Sensitive Data Protection remain in scope for it.15

Cost signal

Model Armor’s screening is priced per token. A Security Command Center Enterprise or Premium subscription includes 3 billion tokens per month at no cost, project-level and organization-level Premium activation and standalone use include 2 million, and further screening costs $0.10 per million tokens on the same four-characters-per-token definition the Agent Platform uses; Sensitive Data Protection inside Model Armor adds no charge.25 A Security Command Center subscription costs a minimum of $15,000 a year at Premium and at Enterprise.25 The Enterprise tier shuts down on 2027-05-21, and organizations on it move to Premium.26

The Data plane carries the labor. With no answer-time narrowing control documented, an answer is bounded by the permissions on the reachable corpus, which makes Drive and Gmail permission remediation a standing program rather than a purchase.

Status watch

  • Model Armor states no launch stage for its core screening service. Google announces GA for named features and integrations — streaming sanitization for text on 2026-07-10, Model Armor on Agent Gateway on 2026-06-24, the Agent Platform integration on 2025-12-03 — and the VPC Service Controls table’s GA scopes to “this product integration”.56 Image screening carries a Preview banner.3 A buyer states a support requirement against the integration it uses.
  • Two withdrawal dates sit inside a normal procurement cycle. Google Cloud DSPM shuts down on 2027-02-01 and the Security Command Center Enterprise tier on 2027-05-21.826 A Canadian institution running a 12-to-18-month procurement cycle chooses a product that outlives the choice.
  • Workspace data regions offer the United States or Europe. Gemini prompts and responses are covered data at rest and during processing, the processing half varies by edition, and Canada is not one of the locations offered.9 Retention for Workspace prompts and responses runs 90 days to indefinite as determined by admins.17
  • Agent Platform Threat Detection carries a page-level Preview banner, and a buyer who needs runtime detection against a deployed agent runs a Preview service to get it.11

Notes

Footnotes

  1. Google Cloud — Agent Identity overview, fetched 2026-09-16. SPIFFE-based per-agent identity with 24-hour X.509 certificates and certificate-bound access tokens; the page states no launch stage. ↩ ↩2

  2. Google Cloud — IAM Access policies overview, fetched 2026-09-16. Declarative agent-action authorization enforced at Agent Gateway through Identity-Aware Proxy; the page’s opening note states “This feature does not support VPC Service Controls” and no launch stage. ↩ ↩2 ↩3 ↩4

  3. Google Cloud — Model Armor overview, fetched 2026-09-16. Filter categories, enforcement modes and the Private Service Connect requirement; states a launch stage for image screening (Preview) and none for the core screening service. On image screening: “Model Armor screens images provided in the prompts and responses”, by “Visual scanning” and “Optical character recognition (OCR)”, and “Image screening is supported only in the us and eu multi-regions.” ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  4. Google Cloud — Check grounding with RAG, fetched 2026-09-16. Returns a 0-to-1 support score with claim-level citations for filtering at inference time; the page states no launch stage. ↩

  5. Google Cloud — Model Armor release notes, fetched 2026-09-16. Dated entries announcing GA for individual Model Armor features and integrations, with no entry for the service itself. ↩ ↩2

  6. Google Cloud — VPC Service Controls supported products, fetched 2026-09-16. GA integration status for Model Armor, Agent Runtime, Secure Web Proxy and Sensitive Data Protection; Agent Gateway does not appear on the page. ↩ ↩2 ↩3 ↩4 ↩5

  7. Google Cloud — Integrate Model Armor with services or frameworks, fetched 2026-09-16. Names the six supported integrations and records that only the Gemini Enterprise integration screens documents. ↩ ↩2 ↩3

  8. Google Cloud — Data Security Posture Management overview, fetched 2026-09-16. Google-Cloud-scoped asset types, three Preview-stage controls, no page-level launch stage, and shutdown on 2027-02-01. ↩ ↩2 ↩3 ↩4

  9. Google Workspace — Data covered by data regions, fetched 2026-09-16. Gemini prompts and responses covered at rest and during processing, the processing column gated by edition, and the United States or Europe as the only locations. ↩ ↩2 ↩3

  10. Google Cloud — Observability for AI agent developers, fetched 2026-09-16. Cloud Trace extracts events from generative-AI spans that conform to the OpenTelemetry semantic conventions; the page states no launch stage. ↩ ↩2

  11. Google Cloud — Agent Platform Threat Detection overview, fetched 2026-09-16. Page-level Preview banner; detects malicious binaries, container escapes, reverse shells, attack tools and control-plane activity. ↩ ↩2 ↩3 ↩4 ↩5

  12. Google Workspace — Manage access to Gemini features in Workspace services, fetched 2026-09-15. Per-organizational-unit enablement of Gemini features. ↩ ↩2

  13. Google Workspace — Explore the AI control center, fetched 2026-09-15. The administrative control centre and its usage review. ↩ ↩2 ↩3

  14. Google Cloud — Assured Workloads control packages, fetched 2026-09-16. The four Canadian control packages, their tiers and the personnel screening each applies. ↩ ↩2

  15. Google Cloud — Assured Workloads supported products, fetched 2026-09-16. Product membership per package: 112 products for Canada Data Boundary, 112 for Canada Data Boundary and Support, 109 for Data Boundary for Canada Protected B, with Model Armor absent from the last. ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  16. Google Workspace — About DLP for Gemini, fetched 2026-09-15. Data-loss-prevention rules bounding the data sources the assistant reaches. ↩

  17. Google Workspace — Generative AI privacy hub, fetched 2026-09-16. Training-use commitments with their qualifiers, and retention of 90 days to indefinite for Workspace prompts and responses. ↩ ↩2

  18. Google Workspace — What controls Gemini’s access to Workspace data, fetched 2026-09-16. Permission inheritance, the administrator’s wholesale lever, and the Drive-download and delegated-Gmail narrowings. ↩ ↩2

  19. Google Cloud — Agent observability, fetched 2026-09-16. Names agent drift as a risk and documents no drift detector, anomaly rule or baseline. ↩

  20. Google Cloud — Agent locations, fetched 2026-09-16. Both Canadian regions carry “v1 is supported for GA features. v1beta1 is supported for Preview features.” ↩ ↩2

  21. Google Cloud — Gemini Enterprise Agent Platform deployments and endpoints, fetched 2026-09-16. Model-serving locations, listing Montréal and not Toronto, and stating that endpoints guarantee neither data residency nor in-region ML processing. ↩ ↩2

  22. Google Cloud — Model Armor feature availability for templates by region, fetched 2026-09-16. Lists Toronto as a limited-support region and names the filters a residency-enforced template keeps and loses. ↩ ↩2 ↩3

  23. Google Cloud — Gemini Enterprise Agent Platform data residency, fetched 2026-09-16. Per-model ML-processing table carrying one Canadian column, Canada (northamerica-northeast1), and a separate partner-model table with no Canada column. ↩ ↩2 ↩3

  24. Google Cloud — Model Armor data residency and endpoints, fetched 2026-09-16. Canada’s template row reads Yes / Yes / Yes and its floor-settings row for the Agent Platform integration reads Yes / No / No, with the page defining that No. ↩ ↩2

  25. Google Cloud — Security Command Center pricing, fetched 2026-09-16. Model Armor token allocations and the $0.10 per million rate, and the $15,000 minimum annual subscription at Premium and Enterprise. The page carries no shutdown date. ↩ ↩2

  26. Google Cloud — Security Command Center service tiers, fetched 2026-09-16. Carries the banner stating that the Enterprise service tier shuts down on 2027-05-21 and that organizations using it move automatically to Premium; the same banner appears on the Data Security Posture Management overview. ↩ ↩2

Graph View

Backlinks