Google published an open-source Customer Support & Returns Agent on August 17 that demonstrates three controls around an ADK and Gemini workflow: signed database writes, isolated generated code and deterministic action checks. A simulated attack shows how external controls can stop an agent from turning a $149 order into a $10,000 refund or exposing environment variables.
Google published an open-source Customer Support & Returns Agent on August 17 that demonstrates how infrastructure controls can constrain an ADK and Gemini workflow with permission to write refunds and generate code. The example combines signed database writes, isolated code execution and deterministic checks around model inputs and actions.
The project uses a deliberately adversarial refund request to make the risk concrete. A customer with a $149 order asks the agent to issue a $10,000 refund and print environment variables. Google argues that a prompt such as "never refund more than the order total" is not a security boundary because model instructions can be bypassed or behave differently after prompt and model changes.
Three controls outside the model
The reference design gives every state-changing database write a cryptographic signature tied to the responsible agent. The database verifies the signature before accepting the mutation, and a separate audit can detect later tampering. The local demonstration uses HMAC; Google recommends an agent-specific service account and hardware-backed Cloud KMS key for production deployments.
Generated code is treated as another untrusted boundary. Google proposes running it inside a gVisor sandbox with no network egress and strict CPU, memory and time limits. The repository's browser dashboard simulates that isolation, while its production guidance points teams to managed gVisor-backed environments rather than claiming the local visualization is itself a hardened sandbox.
A Semantic Gateway supplies the third layer. Deterministic rules inspect requests and proposed actions for secrets, jailbreak patterns and business-limit violations before sensitive operations execute. Google recommends testing those policies as software contracts so prompt or model changes do not silently weaken them.
What the demo proves—and what it does not
This is a reference implementation, not an independent measurement of a deployed production system. Its value is architectural: it places authorization, attribution and containment outside the model's probabilistic reasoning. For teams giving agents access to databases, internal APIs or code execution, the pattern separates useful autonomy from the authority to make unconstrained changes.
Key Points #
- 1Google's reference design signs database writes, isolates generated code and applies deterministic checks outside the model.
- 2The $10,000 refund attack demonstrates why system prompts alone cannot enforce financial or data-access boundaries.
- 3The repository is a reference implementation; its local dashboard simulates parts of the production isolation guidance.
Scoring Rationale #
Google provides a concrete open-source architecture for constraining state-changing agents, with practical patterns for identity, code isolation and deterministic policy enforcement. Its value is high for builders, while the score is moderated because it is a reference implementation rather than independent production evidence.
Sources #
Primary source and supporting public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
[Active Search Campaigns by BudgetEasy](/problems/sql/active-search-campaigns-by-budget)
[High CPC Clicks & Poor Landing PagesMedium](/problems/sql/high-cpc-clicks-poor-landing-page)
[Campaign ROAS by Attribution ModelHard](/problems/sql/campaign-roas-by-attribution-model)
250 free problems · No credit card