Build zero-trust AI agents that judge intent, not just syntax

This is Part 2 of the zero-trust agents series. Part 1 established three deterministic controls for autonomous agents: signed database writes with Cloud KMS, user-space kernel isolation with gVisor, and an input/output gateway backed by CI unit tests.

Those controls work, but they share one limit: they only catch cases you can explicitly specify ahead of time. A SQL parser cannot tell a socially engineered refund from a legitimate one if the syntax is valid. A regex cannot tell the difference between a physical USB cable and an opened software license. A single-turn test suite cannot catch an agent fleet being drained across multiple turns.

Part 2 takes the same Customer Support & Returns Agent built with the Agent Development Kit (ADK) and moves security checks to the platform, where they reason about intent and adapt to behavior. Moving the checks to the platform also changes who owns them: governance is defined and managed by a platform or security administrator, separate from the agent developer, because the platform enforces it outside the agent code.

From code-level checks to managed runtime governance

A zero-trust runtime assumes each individual request can look valid and still be part of an attack. Instead of hard-coding every rule in advance, it enforces three managed controls — all applied through Agent Gateway, the runtime enforcement point that intercepts and governs interactions between the user, the agent, its model, and its tools:

• Model Armor — an in-line AI firewall that screens prompts and responses for prompt injection, jailbreaks, malicious URLs, and sensitive data leakage.
• Semantic Governance Policies — an LLM-based natural-language policy engine that evaluates each proposed tool call against user intent and your business rules before the call runs.
• Agent Anomaly Detection — LLM-driven agent log and telemetry analysis that flags unusual behavior across a session, such as a refund drained across many turns.

Each control covers what the others cannot: Model Armor filters the payload, the policy engine reasons about intent, and anomaly detection watches behavior over time.

The concrete scenario

The refund agent reads orders, computes restocking fees against a merchant ledger, and pays refunds — with calculate_restocking_fee running inside Agent Sandbox, the platform's managed sandbox for model-generated code. The attacks are run against a single transaction where the split between physical and digital goods (a $29 USB-C docking station vs. a$120 digital license, for example) is what the attack patterns turn on.

All code, policy declarations, and interactive simulators are available in the open-source companion demo: zero-trust-agents-2.

Bottom line

The series' core argument: build-time, syntax-level guardrails are necessary but insufficient once agents make judgment calls. Shifting governance to the platform — where an intent-level policy engine and a behavior-watching anomaly detector sit between the agent and everything it can do — is the difference between a demo and a deployable agent. It also fixes the ownership problem: the agent developer stops being the security team.