Google Genkit adds Agents API with detached runs, human approval

Key Takeaways

• Genkit's new Agents API unifies message history, tool execution, streaming, and state persistence behind a single chat() interface
• Detached turns let clients start agent tasks, disconnect, and poll for results without holding connections open
• Interruptible tools pause mid-execution for human approval, with anti-forgery validation against session history

Google released the Agents API in preview for Genkit, its open-source framework for building AI applications. The API bundles message history, tool execution, streaming, state persistence, and a frontend protocol into a single chat() interface. It works the same way whether your agent runs in-process or behind an HTTP endpoint. TypeScript and Go support shipped now; Python and Dart are coming.

The design goal is clear: one abstraction that scales without forcing developers to swap primitives. The same agent object handles a one-shot reply, a streamed multi-turn conversation, a paused tool call awaiting human approval, or a detached long-running task. You don't need a different framework component when your chatbot grows into a multi-agent workflow.

What separates Genkit's state model from other agent frameworks?

Most frameworks conflate two kinds of agent data. Genkit separates them explicitly. Custom state is typed application data that drives the next turn: workflow status, task lists, selected entities. Artifacts are generated outputs the user might inspect, download, or version independently: a report, a code patch, a travel itinerary. Tools can update either through the active session, and Genkit streams changes to the client in real time.

State persistence follows two paths. With a session store configured, the agent is server-managed. Messages, custom state, and artifacts persist as snapshots, and clients reconnect by session ID. Genkit ships stores for Firestore (production multi-instance), in-memory (development), and file-based (local testing). A pluggable interface supports custom implementations.

Without a store, the agent is client-managed. The server returns full state, and the client sends it back on each turn. Ebenezer Don, an AI engineer, noted the compliance angle: "This approach is ideal for ephemeral sessions or applications with strict data residency constraints where the server should not persist user data." The tradeoff is increased network payload as conversations grow.

How do detached turns work?

Detached turns solve a problem every team hits eventually: what happens when an agent task takes minutes or hours? With detached runs, a client can start a task, disconnect, and poll for results later. The agent continues working server-side, writing progress to snapshots that any client can read.

const chat = reportAgent.chat({ sessionId: 'report-123' });
const task = await chat.detach('Write the quarterly market report.');
savePendingSnapshot(task.snapshotId);

for await (const snapshot of task.poll({ intervalMs: 1000 })) {
  renderStatus(snapshot.status);
  if (snapshot.status === 'completed') renderMessages(snapshot.state.messages);
}

This makes long research jobs, multi-step planning, and tool-heavy workflows practical without WebSockets, a separate job queue, or holding a connection open. For teams building agents that do substantive work, this is the feature that changes the architecture.

How does human-in-the-loop approval work?

Interruptible tools give developers fine-grained control over what agents can do autonomously. When a tool is marked interruptible, the agent pauses mid-execution, returns the pending action to the client, and resumes only after the user approves or rejects. The runtime validates the resume payload against session history, preventing a tool from running with forged input.

runShell := genkitx.DefineInterruptibleTool(g, "run_shell", "Run a shell command after a safety check.",
  func(ctx context.Context, input ShellInput, confirm *Confirmation) (ShellOutput, error) {
    if isRisky(input.Command) {
      if confirm == nil {
        return ShellOutput{}, tool.Interrupt(ShellInterrupt{
          Command: input.Command,
          Reason:  "The command can modify files.",
        })
      } else if !confirm.Approved {
        return ShellOutput{}, errors.New("user rejected shell command execution")
      }
    }
    return execute(input.Command)
  },
)

The anti-forgery protection matters. In production systems, you need to guarantee that a malicious client cannot inject a fake approval for a tool call it never saw. Genkit validates against the session's actual history.

Multi-agent orchestration and middleware

Genkit's middleware system, shipped in May, enables multi-agent setups. It injects a delegation tool for each sub-agent, so an orchestrator model can route parts of a request to specialists. Sub-agents can run locally or behind HTTP endpoints using the same chat() interface.

The middleware layer also provides composable hooks for retries with exponential backoff, model fallbacks across providers, tool approval gates, and a skills system that loads SKILL.md files into the system prompt. These aren't novel features individually, but having them built into the framework means less glue code.

Where Genkit fits in the agentic framework landscape

The agentic framework space is crowded. LangChain dominates mindshare in Python. Microsoft's Semantic Kernel targets .NET shops. CrewAI focuses on multi-agent orchestration. AutoGen from Microsoft Research emphasizes conversational agents. Genkit's pitch is different: it integrates tightly with Firebase and Google Cloud while staying model-agnostic, supporting Gemini, OpenAI models, and open-source alternatives.

For teams already using Firebase or Google Cloud, Genkit removes friction. For teams using other infrastructure, the value proposition depends on whether the chat() abstraction and detached turns solve problems they're currently fighting with custom code.

Frequently Asked Questions

What languages does Genkit Agents API support?

TypeScript and Go are supported now. Python and Dart support is planned but not yet available.

Does Genkit work with models other than Gemini?

Yes. Genkit is model-agnostic and supports OpenAI models, open-source alternatives, and other LLM providers alongside Gemini.

What is a detached turn in Genkit?

A detached turn lets a client start an agent task, disconnect, and poll for results later. The agent continues working server-side and writes progress to snapshots.

How does Genkit handle state persistence?

Genkit offers two modes. Server-managed mode uses a session store (Firestore, in-memory, or file-based) to persist state. Client-managed mode returns state to the client, which sends it back on each turn.

What does human-in-the-loop mean in Genkit?

Interruptible tools pause execution and return pending actions to the client for approval. The agent resumes only after the user approves or rejects, with anti-forgery validation against session history.

Source: InfoQ