Google just boxed agents into a managed runtime: Agent Compute Engine (preview) gives platform teams a Google-managed execution plane for agent workloads while simultaneously stretching agent governance across Cloud Run, GKE, Agent Runtime, and Gemini sandboxes. That's the most consequential part of this week's announcements — not the marketing around "managed agents," but the new trust boundary and operational surface that comes with it.
Agent Compute Engine is presented as a managed compute service for agents; for teams that need Kubernetes-level control, Google also released Agent Substrate — an open-source, zero-trust execution runtime you can run on GKE. The two-pronged approach is the right call: give customers a straightforward managed path and an auditable, portable runtime for sensitive deployments. But don't kid yourself — this splits platform strategy into two very different operational models.
The governance story is the part most teams will under-estimate. Google extended agent governance across Agent Runtime, Cloud Run, Gemini platform sandboxes, GKE, and Agent Compute Engine itself, and documented mechanisms for authenticated agent-to-tool connectivity that include injecting short-lived identity tokens into agent processes. That last detail matters: authenticated identity injection into agent processes is functionally the same problem as credential provisioning for CI runners — except agents are designed to reach out and act on external systems. If you treat Agent Compute Engine or a Cloud Run endpoint like just another service, you will lose.
For teams planning to integrate Gemini Enterprise inside Cloud Run, Google documented an MCP application pattern that explicitly recommends a private service exposing a /mcp JSON-RPC endpoint and using these deployment flags as a baseline:
gcloud run deploy SERVICE --source . --no-allow-unauthenticated --no-cpu-throttling --min-instances=1Those flags are telling: --no-cpu-throttling and --min-instances=1 are about steady runtime availability (agents hate cold starts), and the private/no-unauthenticated combination is about reducing blast radius — but network isolation and token scoping need to be baked into infra and audit pipelines, not left to app developers.
Operational implications (short): you now have to treat agent runtimes like any other hosted runtime that can act on your systems. That means: attestation, fine-grained OAuth scopes for injected identity tokens, egress and DNS controls, and defender playbooks for compromised agents. Identity-token injection is a useful primitive, but it also becomes a pivot point: if an agent can automatically obtain and use tokens scoped to tooling and infra, it's a brand-new path for lateral movement.
Sovereign AI and hardware: Google's Distributed Cloud air-gapped options grabbed my attention because they make high-end Gemini models available in more realistic enterprise footprints. Google is enabling enterprise search and other Gemini-driven features for select air-gapped deployments, and offering NVIDIA HGX-class hardware in those Distributed Cloud environments. If your compliance requirements pushed you away from cloud-hosted models, the combination of recent Gemini models on HGX-class hardware in air-gapped distributed cloud nodes changes the calculus — you get up-to-date model performance inside a network envelope you can control.
Two final, blunt takes:
- This is the right product split: managed engine for speed, Agent Substrate for control. Teams that don't pick one will create brittle DIY solutions and endless postmortems. Treat the selection as architecture, not ops detail.
- Everyone will under-invest in agent attestation and token governance. If your threat model includes automated actors (it should), treat agent runtimes as first-class principals in IAM and monitoring now.
If you run agents at any scale, start treating Agent Compute Engine like a new runtime in your fleet: inventory it, map its token flows, and fold it into incident response. The era where "agents" were throwaway scripts is over — they now have service levels, hardware targets, and audited identity paths. The teams that win will be the ones who treat agents like production services from day one.