Google's Runtime Governance Shields AI Agents From Intent-Based Attacks

Google's latest guidance on securing autonomous AI agents moves beyond syntax-checking and hard-coded rules to a platform-level approach that judges user intent and detects behavioral anomalies across entire sessions.

The framework—described as Part 2 of Google's zero-trust agent series—keeps the deterministic controls from Part 1 (cryptographic signing, sandboxing, input/output gating) but layers on three additional runtime guardrails that operate outside the agent's code. By shifting enforcement to the platform, security governance can now be managed independently by administrators rather than baked into application logic.

Three Managed Runtime Controls#

The Agent Gateway, Google's runtime enforcement layer, implements three complementary defenses:

• Model Armor: An inline AI firewall that screens prompts at ingress for injection attacks and jailbreaks before the model runs, and redacts sensitive data at egress (credit card numbers, API keys, employee IDs) before responses leave the gateway.
• Semantic Governance Policies: A natural-language policy engine that evaluates each proposed tool call against conversational context and business rules—written as plain-text constraints readable by non-technical stakeholders—before execution.
• Agent Anomaly Detection: LLM-driven telemetry analysis that flags unusual patterns across a session: high tool-call velocity, repeated writes to a single entity, and cumulative parameter values exceeding safe thresholds.

Where Deterministic Rules Fall Short#

The post illustrates four real attack scenarios that traditional syntax-based controls allow through:

A brute-force prompt injection ("Ignore all previous instructions...") is caught by Model Armor at the perimeter before the model runs, avoiding token consumption and context pollution.

A socially engineered refund request for a digital software license reads as syntactically valid—correct SQL types, under the order total—but violates company policy (digital goods over $30 require manager approval). Semantic Governance policies intercept the issue_refund tool call and deny it, because the engine can reason about what "Google Workplace user license" means in business context, where a regex or keyword filter cannot.

An attacker learns the single-refund threshold ($30) and splits a larger theft across eight consecutive conversation turns, each request individually legitimate. A single-turn policy engine approves each $20 refund independently, but Agent Anomaly Detection identifies the pattern: repeated tool calls, single-entity write velocity, and cumulative drainage ($160 from a $149 order). The platform raises a threat finding in Security Command Center.