Google just shipped a new, concrete thing you can't ignore: Agent Compute Engine in Preview — a purpose-built, hardware‑isolated runtime for agents. That matters because for the first time Google is treating agent processes not as ordinary workloads but as execution primitives with their own isolation, lifecycle, and governance surface.
This is the right call. The alternative was leaving teams to invent ad‑hoc credential injection, background daemons, and bespoke sandboxing — exactly the kind of brittle, unobservable plumbing that breeds incidents. But it's not a magic bullet: hardware isolation helps runtime safety, it doesn't solve identity, least privilege, or observability. Those are now everyone's problem.
The shape of the launch: Agent Compute Engine (Preview) plus expanded agent governance across Agent Runtime, Cloud Run, GKE, and related surfaces. Google also shipped an open‑source, Kubernetes‑native substrate on GKE — think CRDs and controllers that implement idle‑agent snapshotting and resume semantics rather than an opaque managed runtime. That felt overdue and I like it: teams that want control can run agents with Kubernetes primitives instead of treating agents as black boxes.
The IAM problem nobody planned for
Hardware‑isolated agents change code‑execution guarantees but they also create a new trust boundary inside your cluster and cloud account. Agents will be able to access external APIs, secrets, and operator actions on behalf of users — and Google is explicitly extending governance controls to give you checklist items for that. If your policy model still assumes workloads are passive and ephemeral, you're going to be surprised by audit logs showing long‑lived agent sessions, snapshot resumes, and interactive investigator shells.
Two concrete risks to prepare for:
- Ephemeral shells and agent resume behaviors complicate credential lifetimes. Auditability needs to follow the agent, not just the VM or pod.
- Attestation needs to be hardware‑backed. Isolation without attested provenance means attackers can mimic an agent process and inherit good privileges.
llm-d 1.0: distributed inference finally stitched into Kubernetes
If Agent Compute Engine is about execution governance, llm‑d 1.0 is about performance governance. Google released llm‑d 1.0 as an open distributed‑inference stack for Kubernetes that integrates vLLM and other inference runtimes and supports Cloud TPUs and GPUs. Crucially, the GKE inference integrations add the operational pieces platform teams actually need: routing aware of request prefixes, global failover, model‑level policy and health checks, and inference‑signal autoscaling.
This isn't vaporware: routing and model‑level health checks mean you can run heterogeneous tiers (GPU, TPU, hosted) and fail over without dropping context. If you've read our earlier coverage on llm‑d you know this is the integration point where inference libraries stop being research demos and start being platform primitives.
Cloud Run, GKE defaults, and sovereign AI
Other operational bits to file in your calendar:
- GKE channel rollouts have advanced: Rapid and Regular channels have received newer minor releases; zone and regional rollouts still vary, so don't expect instant parity across regions.
- Cloud Run in Preview now exposes interactive SSH‑style debug access to service instances for diagnostics. It's useful, but dangerous if you haven't hardened access — treat it like container exec across fleets and lock it down.
- Google Distributed Cloud expanded support for hosted model deployments and air‑gapped options for Gemini family models; exact model availability and configurations vary by offering and region.
What to do now
Stop thinking about agents as "just another service." Start treating agent execution like a platform capability: define attested identity for agent artifacts, extend your audit/trace model to capture snapshot/resume lifecycles, and add policy gates for model routing and model‑level checks. If you run hybrid or air‑gapped workloads, plan for local, air‑gapped model deployments as a realistic option for non‑egress inference.
Final thought
Google's launches signal a sensible separation: give teams curated hardware isolation and orchestration primitives, and make the control plane responsible for governance and routing. But the hard work shifts left — identity, attestation, and observability can't be outsourced to a preview flag. Platform teams that take this seriously will win the next wave of agentic applications; the rest will be surprised by a new class of elusive incidents.
Sources
- Introducing Agent Compute Engine and expanding agent governance
- Announcing llm-d 1.0: Open distributed inference for agents on Google Cloud TPUs and GPUs
- Google Cloud Release Notes
- Enabling the next era of sovereign AI: The latest Google Distributed Cloud innovations
- Google Cloud infrastructure at NVIDIA GTC Berlin 2026