Build zero-trust AI agents that judge intent, not just syntax

Part 2 of Zero-trust Agents series: runtime governance, intent gating, and adaptive anomaly remediation

In Part 1, we established three deterministic controls for autonomous agents: signed database writes with Cloud KMS, user-space kernel isolation with gVisor, and an input/output gateway backed by CI unit tests.

Those controls work, but they share one limit: they only catch cases that you can explicitly specify ahead of time.

A SQL parser cannot tell a socially engineered refund from a legitimate one if the syntax is valid. A regex cannot tell the difference between a physical USB cable and an opened software license. And a single-turn test suite cannot catch an agent fleet being drained across multiple turns.

Part 2 keeps the same Customer Support & Returns Agent built with the Agent Development Kit (ADK) and moves security checks to the platform, where they reason about intent and adapt to behavior. Moving the checks to the platform also changes who owns them. Governance is defined and managed by a platform or security administrator, separate from the agent developer, \because the platform enforces it outside of the agent code.

Deploying to the Gemini Enterprise Agent Platform, we replace self-hosted container infrastructure and explicitly managed regex lists with managed runtime governance: Model Armor, Semantic Governance Policies, and Agent Anomaly Detection with Closed-Loop Remediation.