/google-cloud-solution-multi-agent-security

name: google-cloud-solution-multi-agent-security
metadata:
  category: MultiProductSolutions
description: >-
  Designs, deploys, and secures Google Cloud Agent Gateway solutions.
  Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGENT), or egress (AGENT_TO_ANYWHERE) patterns involving Model Armor, IAP, and Agent Registry.
  Don't use for general Cloud Load Balancing or basic VPC setup not related to Agent Gateways.

Agent Gateway multi-agent security

Critical Enforcement Rules & Rationale

• **Gcloud Release Tracks**: Always use the exact release tracks specified in

the commands (e.g., `gcloud beta network-services agent-gateways`). Omitting these prefixes causes commands to fail because Agent Gateway features are located in specialized, non-default namespaces.

• **API Enablement**: Include `modelarmor.googleapis.com` in the API

enablement list when setting up guardrails. Excluding it prevents Model Armor policies and filters from successfully attaching to the Gateway.

• **Egress Verification**: Egress policy verification requires using the

Python script ([scripts/verify_egress_policies.py](scripts/verify_egress_policies.py)), not `curl`. Egress gateways rely on runtime SDK lifecycle handling and JWT context that a standard curl command cannot simulate correctly.

• **Model Armor Keys**: In `model-armor-config.yaml`, always include both

`piAndJailbreakFilterSettings` and `sdpFilterSettings` (`filterEnforcement: ENFORCE`). Invalid or missing filters cause deployment validation failures or lead to silent bypasses of the guardrails.

• **Subnet Private Access**: Any subnet hosting a Private Service Connect

network attachment for Egress Gateways must have `private_ip_google_access = true` enabled in Terraform. Disabling this blocks connectivity to Google-managed endpoints, causing total routing failures for agents.

• **Direct Delivery**: Immediately provide the requested architecture,

configuration files, CLI commands, scripts, and diagrams in full. Do not stop at a planning phase, do not generate a plan artifact, and do not ask for user confirmation before delivering outputs.

• **No Infrastructure Execution**: Do not attempt to run deployment or

verification commands (such as `gcloud`, `kubectl`, `terraform`, or `curl`) against real cloud resources during design. You are generating plan configurations, not executing them.

> [!IMPORTANT] **Just-In-Time (JIT) Resource Loading Protocol:** Inspect > template files in [assets/](assets/) and executable scripts in > [scripts/](scripts/) using `view_file` as needed for extended configurations, > deployment scripts, and test suites.

--------------------------------------------------------------------------------

Quick Reference: Required Filenames

Always generate files with these exact names when requested:

1. `agw-ingress-config.yaml` ([assets/agw-ingress-config.yaml](assets/agw-ingress-config.yaml)) 2. `agw-egress-config.yaml` ([assets/agw-egress-config.yaml](assets/agw-egress-config.yaml)) 3. `agw-authz-extension.yaml` ([assets/agw-authz-extension.yaml](assets/agw-authz-extension.yaml)) 4. `agw-authz-policy.yaml` ([assets/agw-authz-policy.yaml](assets/agw-authz-policy.yaml)) 5. `model-armor-config.yaml` ([assets/model-armor-config.yaml](assets/model-armor-config.yaml)) 6. `sgp-policy.yaml` ([assets/sgp-policy.yaml](assets/sgp-policy.yaml)) 7. `iap-policy.json` ([assets/iap-policy.json](assets/iap-policy.json)) 8. `model-armor-payload.json` ([assets/model-armor-payload.json](assets/model-armor-payload.json))

--------------------------------------------------------------------------------

1. Dual Ingress & Egress Architecture Design (`dual_ingress_egress_architecture_design`)

• **Ingress Pattern**: `CLIENT_TO_AGENT` fronted by Ingress Control Plane

(Agent Gateway, Model Armor).

• **Egress Pattern**: `AGENT_TO_ANYWHERE` utilizing Egress Control Plane

(Agent Gateway, `roles/iap.egressor` CEL policies, Cloud DNS) and Egress Data Plane (PSC Interface, Cloud Run, PSC Google APIs Global Endpoint), coordinated via Agent Registry & Agent Engine runtime.

• **Mermaid Diagram**:

    graph TD
        Client["External Clients"] -->|HTTPS / MCP| GLB["Global Load Balancer"]
        GLB --> Ingress["Ingress Agent Gateway (CLIENT_TO_AGENT)"]
        Ingress --> MA["Model Armor (CONTENT_AUTHZ)"]
        MA --> Agent["Agent Engine Agents (BillingAgent, SupportAgent, FraudAgent)"]
        Agent --> Egress["Egress Agent Gateway (AGENT_TO_ANYWHERE)"]
        Egress --> PSC["Private Service Connect Network Attachment"]
        PSC --> Tools["Private MCP Tool Backends"]

--------------------------------------------------------------------------------

2. Ingress & Egress Guardrail Policy Config (`ingress_and_egress_guardrail_policy_config`)

When requested for Ingress & Egress guardrail policy configs, you MUST generate and create all required files in the workspace:

• `agw-ingress-config.yaml`

([assets/agw-ingress-config.yaml](assets/agw-ingress-config.yaml)): Declares `governedAccessPath: CLIENT_TO_AGENT` with protocols `HTTP` and `MCP`.

• `agw-egress-config.yaml`

([assets/agw-egress-config.yaml](assets/agw-egress-config.yaml)): Declares `governedAccessPath: AGENT_TO_ANYWHERE` with protocol `MCP`.

• `agw-authz-extension.yaml`

([assets/agw-authz-extension.yaml](assets/agw-authz-extension.yaml)): Configures AuthzExtension service for IAP authorization.

• `agw-authz-policy.yaml`

([assets/agw-authz-policy.yaml](assets/agw-authz-policy.yaml)): Configures `AuthzPolicy` action `ALLOW` targeting both Ingress and Egress gateways.

• `iap-policy.json` ([assets/iap-policy.json](assets/iap-policy.json)): Binds

`roles/iap.egressor` with CEL condition checking `iap.googleapis.com/mcp.toolName == 'get_acc