The Hidden Architecture of Google’s Managed Agents #
On the surface, the recent update to Google’s Managed Agents in the Gemini API appears to be a standard SDK iteration. The September 2026 preview, which introduces the antigravity-preview-09-2026 environment and upgrades the default model from Gemini 3.5 Flash to Gemini 3.8 Flash, is certainly a welcome performance boost for developers. However, the true significance of this release lies not in the model versioning, but in the underlying Credentials API architecture that Google has deployed to manage agent security.
The core of this new harness is a sophisticated approach to credential handling that fundamentally changes how agents interact with external services. By utilizing an egress proxy model, Google ensures that sensitive secrets never actually reside within the ephemeral Linux sandbox where the agent executes. When an agent needs to authenticate with an external API, the proxy performs HTTP header transforms — such as injecting an Authorization: Bearer token — on the fly. The model itself never sees these raw tokens, and they are never embedded in the sandbox code or environment variables. This architectural choice represents a distinct strategy for mitigating the risks inherent in autonomous agent execution.
This development is part of a broader, rapid formalization of the agent identity and governance stack. In a single week in September 2026, four major vendors introduced four distinct credential architectures, highlighting the industry’s intense focus on securing agentic workflows. Beyond Google’s egress proxy, Rubrik implemented short-lived scoped tokens co-engineered with Anthropic, Microsoft added MCP Firewall to Entra Agent ID for discovering and controlling agent MCP server usage, and NVIDIA shipped named-provider credentials in OpenShell’s policy-based sandboxing layer. These moves collectively signal that the industry is moving past the experimental phase of agent deployment and into a period of rigorous infrastructure hardening.
The governance stack is now clearly delineated into four functional layers: build-time policy enforcement, such as that provided by Cisco’s Agent SDK; runtime management, exemplified by WSO2 Agent Manager and NVIDIA OpenShell; data-security layers like Rubrik’s MCP implementation; and now, the managed harness layer represented by Google. By providing a standardized environment that handles both the execution sandbox and the credential lifecycle, Google is positioning itself as a foundational provider in this emerging stack.
The developer experience within this harness is also highly structured. Configuration is managed through version-controllable files: AGENTS.md, which is auto-loaded as system instructions for persona and guideline definition, and SKILL.md, which allows for the modular extension of agent capabilities. These files, which can be mounted from Git repositories or Google Cloud Storage objects, ensure that agent behavior is as reproducible and auditable as the application code itself.
Despite these advancements, several questions remain regarding the long-term interoperability of these disparate governance models. As enterprises begin to mix and match tools from different vendors, how will these varied credential architectures — proxy-based, token-based, and identity-based — interact within a single, complex agentic workflow? Furthermore, as the industry continues to iterate on these layers, we must consider whether the current trend toward vendor-specific managed harnesses will lead to a unified standard or a fragmented landscape of proprietary security models. For now, Google’s approach provides a clear, robust path for developers looking to balance agent autonomy with enterprise-grade security.