Google opens Agent Runtime, Identity, and Gateway to all users

Key Takeaways

• Agent Runtime now supports continuous execution for up to 7 days, enabling week-long automated workflows
• Agent Identity introduces a new IAM type that binds permissions directly to agent runtime, eliminating dormant credentials
• Agent Gateway provides centralized governance with Model Armor protection against prompt injection and data leakage

Google is making the core infrastructure of its Gemini Enterprise Agent Platform available to all customers. Agent Runtime, Agent Identity, Agent Gateway, and several other features that were previously limited or in preview are now generally available. The company also announced CodeMender, a managed code security agent that moves beyond passive vulnerability scanning to automated remediation.

The release targets a specific problem: most enterprise AI agents hit a wall when workflows stretch beyond a single session. They lose context, require manual babysitting, and create security blind spots when they access sensitive systems. Google's answer is a stack that handles memory, multi-day execution, and identity management as first-class concerns.

What does Agent Runtime actually do for long workflows?

Agent Runtime lets agents execute continuously for up to 7 days. That's not a typo. Google is explicitly targeting asynchronous enterprise workflows that can't wrap up in a single API call: multi-stage sales sequences, IT incident response chains, vendor compliance monitoring, or onboarding orchestration that spans a week.

The companion feature, Agent Memory Bank, handles the context problem. You define structured schemas, and the system automatically extracts and maintains conversation context, user preferences, past decisions, and account history. When the agent picks up work on day four of a seven-day workflow, it has the full history without re-prompting or context stuffing.

For DevOps teams already running sales automation through tools like HubSpot or Salesforce, this creates an interesting integration question. Agent Runtime could orchestrate sequences that span CRM updates, email outreach via ActiveCampaign, and Slack notifications, all without losing thread.

How Agent Identity changes the security model

Agent Identity is a new native IAM type built on open standards. The core principle: least-privilege access bound directly to the agent runtime, not to a service account that outlives it.

Three specific problems this solves:

• Token theft mitigation: Access tokens are bound to the runtime itself. Steal the token, and it's useless outside that specific agent execution.
• Non-repudiable auditing: Every action the agent takes is logged against its identity. You can trace exactly what happened and when.
• Automatic lifecycle management: No more dormant credentials. When an agent stops running, its identity expires.

For security teams, this is significant. The common pattern of giving an AI agent a long-lived service account with broad permissions is a disaster waiting to happen. Agent Identity forces a tighter model.

What does Agent Gateway protect against?

Agent Gateway acts as a central control point for all agent interactions. It's where you enforce access controls, apply natural language rules, and run Model Armor, Google's inline protection layer.

Model Armor specifically guards against three attack vectors that keep security teams up at night:

1. Prompt injection: Malicious inputs that hijack agent behavior
2. Tool poisoning: Compromised external tools that feed bad data to agents
3. Data leakage: Agents accidentally exposing sensitive information in outputs

Google cites Broadcom, Palo Alto Networks, and Ping Identity as customers already using Agent Gateway to govern agents at scale. That's a strong signal that enterprise security teams are taking agentic AI seriously and demanding centralized controls.

Agent Registry: solving the sprawl problem

The dirty secret of enterprise AI adoption is agent sprawl. Every team builds their own agents. Nobody knows what already exists. Duplicate work multiplies. Governance becomes impossible.

Agent Registry provides a single library view of all AI agents, servers, and connections across an organization. Teams can find and reuse existing agents rather than building from scratch. Administrators get visibility into what's running where.

This matters most for organizations running automation stacks with tools like Zapier or Make alongside AI agents. Knowing which automations connect to which agents, and which agents are actually being used, is table stakes for governance.

Observability and evaluation on a single engine

Google is combining observability (what your agent did) and evaluation (whether it was any good) into one system. The metric you iterate against during development is the same one grading the agent in production.

Agent Evaluation offers multiple approaches: pre-built metrics, custom Python evaluators, LLM-as-a-judge scoring, and adaptive rubrics co-developed with Google DeepMind. Online evaluation monitors run continuously, flagging performance degradation and behavioral drift before they become incidents.

Agent Observability provides end-to-end visibility into agent decision-making. You can trace the reasoning path, see which tools were called, and understand why an agent made a specific choice.

CodeMender: from passive scanning to automated remediation

Alongside the platform updates, Google announced CodeMender, a managed code security agent. The pitch: move beyond passive vulnerability scanning to automated code remediation. The goal is reducing zero-day risk by fixing issues rather than just flagging them.

Details are thin in this announcement, but the positioning suggests CodeMender will compete directly with GitHub's Copilot-based security features and the newly open-sourced Codex Security CLI from OpenAI.

How do these features compare to alternatives?

Frequently Asked Questions

What is the maximum runtime for Gemini Agent Platform agents?

Agent Runtime supports continuous execution for up to 7 days, allowing agents to handle week-long asynchronous workflows without losing context.

How does Agent Identity prevent token theft?

Agent Identity binds access tokens directly to the agent runtime. If a token is stolen, it cannot be used outside that specific agent execution context.

What attacks does Model Armor protect against?

Model Armor guards against prompt injection, tool poisoning, and data leakage through inline protection at the Agent Gateway level.

Is Agent Registry required to use the platform?

No, but Agent Registry provides centralized visibility into all agents across an organization, helping prevent duplicate work and enabling governance at scale.

What is CodeMender?

CodeMender is a managed code security agent that automates code remediation rather than just flagging vulnerabilities, aiming to reduce zero-day risk.

Source: Cloud Blog