Introducing Agent Compute Engine and expanded agent governance

extract

Introducing Agent Compute Engine and expanded agent governance The Google Cloud infrastructure team At AGNTCon + MCPCon, unveiling the infrastructure behind Gemini for business Blog authors: Nirav Mehta, VP Product Management; Michael Bachman, VP/GM; Kevin Hutchins, VP Product Management Scaling Gemini to planet scale taught us firsthand that securely running autonomous agents is fundamentally an infrastructure challenge. The shift from single-turn prompting to interactive agents requires a new paradigm of execution and control. To support massive concurrent agent sessions, we engineered new compute and governance solutions for Gemini to help solve these challenges. Today at AGNTCon + MCPCon, we are delivering these capabilities to customers by launching Agent Compute Engine, a purpose-built compute service that already powers Gemini as an agent for work tasks. It will be available in preview in the coming months, providing hardware-isolated runtime sandbox security. Additionally, we are extending Gemini for business’ agent governance capabilities to support agents wherever they operate. Together, these capabilities deliver the control you need to run, govern, and scale your agents. Under the hood of Agent Compute Engine Agent Compute Engine arose from the need to handle Google’s massive agentic workloads that write and execute code, run tools, drive browsers, orchestrate enterprise workflows, and iterate rapidly and at scale. While traditional compute primitives are excellent for standard workloads, they weren't optimized for the unique, highly iterative nature of AI agents. Purpose-built for agents, Agent Compute Engine gives every Gemini agent its own high-performance, secure computer to act upon, powering Gemini's dynamic, high-churn sessions. Agent Compute Engine is optimized specifically for the unique lifecycle patterns of AI agents, and you will soon be able to use this service to power your own custom agents. Highlights include: - Speed with efficiency: Agents start, pause, and resume constantly and require an architecture that delivers speed, at scale, all with extreme efficiency. Agent Compute Engine delivers microVMs that boot rapidly, so an agent loop or an eval sweep doesn’t wait on infrastructure. Further, supporting Google users with multiple agents requires a cost-effective solution that can get the most out of a physical machine. Agent Compute Engine achieves this by using copy-on-write memory sharing to run multiple agents on a single operating system template, and pausing idle microVMs via fast checkpoint and restore. When an agent finishes executing a tool call and enters the “thinking” phase of the agentic loop, the microVM signals that it's idle, and the host moves it from an active to an idle state. In other words, it can pause a running microVM while an agent waits on a human or an external system, and quickly resume it from snapshots. - Enhanced security, isolation and governance: As agents take on more complex tasks, the risk of untrusted or adversarial code executing inside a sandbox is an ever-present reality. By running Agent Compute Engine with Titanium, Google’s offload infrastructure processing unit (IPU), we deliver silicon-rooted defense-in-depth built for untrusted AI agents. Agent Compute Engine delivers strong isolation via a hardware-isolated Cloud Hypervisor boundary with its own guest kernel and root access. (For a closer look at Agent Compute Engine’s microVM architecture and security, read the technical deep dive.) Each microVM runs its agent’s own identity, using short-lived credentials. Every microVM also gets its own cryptographically verified ID, and service credentials are injected in egress outside the microVM. Integrated with Agent Gateway, Agent Compute Engine delivers comprehensive observability, policy and security evaluation. - Persistence and enterprise integration: Agents require the ability to persist agent data across multiple, long-running sessions. To solve this, each Agent Compute Engine microVM has its own Hyperdisk, enabling persistence of execution workspaces and agent context. In addition, in order to do meaningful work, they need the ability to use enterprise data without moving it. By weaving Agent Compute Engine directly into Google’s cloud and identity fabric, enterprise connectivity is governed by the exact same security and identity model that protects the microVM itself, enabling a unified identity model as well as auditability. "Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency. Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world." - Gautham Thambidorai, VP & Google Fellow, Gemini Building on GKE with Agent Substrate For platform teams looking for customization and multi-cloud portability, or who have already standardized on Kubernetes, Agent Substrate on Google Kubernetes Engine (GKE) is an open-source execution runtime that brings the same agent-first design to Kubernetes. It’s built on a zero-trust architecture that cleanly decouples agent execution from machine management. When an agent becomes idle, Agent Substrate snapshots its active memory and returns the machine to the pool, then resumes the agent the moment it’s needed again. Because it’s open source and Kubernetes-native, you can customize it, extend it, and run it alongside your existing workloads. Some Agent Substrate highlights include: - High-density: Agent Substrate delivers as much as 10x higher compute density compared to traditional compute while maintaining full kernel isolation and identity-based network security for every agent. - Sub-second activation: In benchmark validation running 200,000 agents, Agent Substrate sustained 500 activations per second at less than 500 ms suspend and resume latency. - Security by default: Think of Agent Substrate as zero-trust for agents. Each sandbox has strong hardware isolation built in using your choice of microVM or gVisor and every agent gets its own cryptographically secure identity paired with egress proxies that enforce granular network policies and inject credentials outside the reach of the agents themselves. Looking ahead, we will expand the Agent Substrate runtime architecture to integrate with our broader Gemini for business governance framework. - Open source portability: Runs on any Kubernetes cluster in any compute environment and works with any agent framework or harness, including Claude Code, OpenClaw, and Hermes. - Dynamic storage: Integrates with Filestore agent volumes with sub-second resume latency to scale alongside active compute, providing a single shared workspace for multi-agent workflows. Leading AI teams like Nous Research are already using this reliable architecture to deploy multi-tenant agents directly into existing customer infrastructure efficiently. “We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control. Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources. Our experience with Agent Substrate gives us confidence the architecture can scale efficiently as agent workloads grow.” - Hervé Bizira, Chief Business Officer, Nous Research Expanding governance capabilities for agents everywhere As organizations transition autonomous agents from isolated pilots to multi-runtime production fleets, traditional security frameworks must be hardened and evolve. Customers face a triple challenge: securing dynamic non-deterministic interaction paths across agents, tools, models, skills and data; maintaining a default deny posture with least-privilege-access distributed runtimes; and ensuring that asynchronous agent actions can be audited. Without strong agent governance, agent sprawl quickly introduces risk — including shadow AI, data exfiltration, and agent actions that are hard to track and audit. To solve these challenges, we built robust agent governance capabilities into Gemini platform, including: - Agent Gateway: Serves as the air traffic controller for client-to-agent and agents-to-anywhere traffic. It integrates a broad set of governance and security policies including sensitive data protection, agent attack protection, semantic governance, and the ability to bring your own policy. - Agent Registry: Provides a central repository that serves as the source of truth for all approved running agents, tools, MCP servers, skills, models and endpoints, governing runtime access via applied policies. - Agent Identity: Assigns a unique secure ID using open standard based SPIFFE to each agent, acting as the digital signature for authentication, access control, and auditing. - Agent observability: Provides OpenTelemetry (OTel)-compliant telemetry adopting agentic semantic conventions, emitting standardized metrics, logs, and distributed traces for every model call, tool invocation, and agent hop across Agent Gateway. Now as agent fleets continue to grow dramatically across diverse environments, we are extending the reach of our Gemini for business agent governance capabilities across Google Cloud runtimes, cross-cloud, on-prem and client devices to manage and secure agents everywhere they run. This includes the following capabilities: - Broad Google Cloud runtime coverage: Extends comprehensive agent governance across Agent Runtime, Cloud Run, Agent Sandboxes in Gemini platform, GKE, and Agent Compute Engine (preview). - Consistent cross-cloud reach: Deploys lightweight, Envoy proxy-based policy enforcement points to extend governance to multicloud and hybrid environments (in preview soon). - Governance for local agents on endpoints: Extends governance to coding agents like Claude Code and Antigravity CLI on managed devices with an OS-level sandbox and local governance services (in preview soon). Additionally we are announcing new agent governance capabilities to Agent Gateway to enable granular cost controls, intelligent model routing, and simplified customizations and integrations. Highlights coming this quarter in preview include: - Granular token and cost governance: Token management provides control over token consumption across agents and models, allowing you to attribute spend, enforce budget guardrails, and provide a single source of truth for token metrics. - Route requests to the right model: Model routing policies route user and agent requests to the right model, controlling costs and improving performance. - Extensible policies: Service Extensions bindings add streamlined support for inline programmability and extensibility. Allows tightly integrating Google services, customers’ bespoke functions, and partner services directly into the datapath. - Expanded security partner ecosystem: Provides delegated user authorization with third-party identity providers Ping Identity, SailPoint, and Saviynt; in addition to secure Oauth using Agent Identity auth manager. Our extensive list of integration partners is here. - Simplified and secure agent-to-tool connectivity: Express Link for Cloud Run allows agents to declare what they need to reach, and it establishes the secure, authenticated connection between components, including identity token injection. “At L’Oréal, our ambition is to put agentic AI in the hands of our teams, empowering them to bring new ideas to life and shape the future of beauty. Through our Beauty Tech Agentic Platform, AI agents are becoming part of everyday work. Google Cloud’s agent governance provides us the foundation to scale this ambition with confidence, unifying identity, policy and observability across runtimes such as Cloud Run. Our developers can innovate faster while we maintain clear control over what each agent can access.” - Alexandre Frizzo, AI Lead Engineer, L’Oreal Build on our resilient agent infrastructure The agentic era requires an evolution in how we scale infrastructure. By combining the high-performance execution of Agent Compute Engine and Agent Substrate with agent governance capabilities from Gemini for business — now expanded with cross-cloud reach — we are establishing a resilient foundation for protected, high-density AI agents. - Learn more about Agent Compute Engine and indicate your interest in Agent Compute Engine. - Help shape Agent Substrate built in the open with the community. Try it on GKE today by visiting its open-source repository. - Learn more about agent governance and indicate your interest. - Come visit us at AGNTCon+MCPCon to speak with experts and see our demos.