Build zero-trust AI agents that judge intent, not just syntax

Summary

Part 2 of the Zero-trust Agents series addresses attacks that deterministic, build-time checks cannot recognize when syntax remains valid. It keeps the Customer Support and Returns Agent, which reads orders, calculates restocking fees in Agent Sandbox, and commits payouts through an issue_refund tool signed with a hardware-backed Cloud KMS key, then moves enforcement to Gemini Enterprise Agent Platform. Agent Gateway applies three runtime controls: Model Armor screens prompts and responses, Semantic Governance Policies evaluates proposed tool calls against intent, history, and business rules, and Agent Anomaly Detection analyzes behavior across a session. The examples cover prompt injection, a non-refundable digital-license refund, and a multi-turn refund drain; detected anomalies can trigger a new policy that blocks subsequent calls without redeploying the agent.

Takeaways

1. 1

   Model Armor can drop matched requests at the perimeter with a 403 before the agent model runs, and it can redact sensitive data such as credit card numbers and Stripe secrets from outgoing responses.

2. 2

   Semantic Governance Policies evaluate proposed tools and parameters against the user prompt, conversation history, and business rules, allowing a natural-language rule to block refunds for digital software licenses over $30 without manager approval.

3. 3

   Agent Anomaly Detection can identify multi-turn behavior such as repeated refunds, while a remediation policy can deny later issue_refund calls for the same order and route the request to a human manager.

FAQ