Build zero-trust AI agents with Google's Agent Development Kit

Summary

Connecting an autonomous Agent Development Kit (ADK) agent to databases, internal APIs, and code execution turns model decisions into production-state changes that system prompts cannot securely constrain. The post presents an open-source Customer Support & Returns Agent built with ADK and Gemini, using an example where prompt injection could produce an unauthorized refund or leak environment secrets. Its zero-trust design combines hardware-backed signing for database mutations, gVisor isolation with no network egress and resource limits for generated Python, and deterministic semantic gateways for prompts, tool calls, and database updates. Local equivalents use HMAC keys, a database ingress verifier, a constrained Docker runner, and Python validation tests, while production mapping uses Cloud KMS, HSM, and VPC Service Controls. The conclusion is that infrastructure-enforced boundaries let the model reason dynamically within strict limits.

Takeaways

1. 1

   Each state-changing write is signed by the specific agent, and an ingress guard verifies the signature before committing the transaction; independent scans can detect later ledger tampering.

2. 2

   Generated Python runs under gVisor with --network=none, all capabilities dropped, a 64 MB memory limit, 0.1 CPU allocation, and a five-second timeout.

3. 3

   The semantic gateway blocks detected secrets, jailbreak signals, and refund updates outside the order limit, with regression tests checking blocked and allowed cases.