---
title: "Build zero-trust AI agents with Google's Agent Development Kit"
description: "Connecting an autonomous Agent Development Kit (ADK) agent to databases, internal APIs, and code execution turns model decisions into production-state changes that system prompts cannot securely constrain. The post presents an open-source Customer Support & Returns Agent built with ADK and Gemini, using an example where prompt injection could produce an unauthorized refund or leak environment secrets. Its zero-trust design combines hardware-backed signing for database mutations, gVisor isolation with no network egress and resource limits for generated Python, and deterministic semantic gateways for prompts, tool calls, and database updates. Local equivalents use HMAC keys, a database ingress verifier, a constrained Docker runner, and Python validation tests, while production mapping uses Cloud KMS, HSM, and VPC Service Controls. The conclusion is that infrastructure-enforced boundaries let the model reason dynamically within strict limits."
---

# Build zero-trust AI agents with Google's Agent Development Kit

[Google](https://yomu.fyi/company/google) · Shubham Saboo, Eric Dong · Aug 17, 2026

**Type:** Explainer

## Summary

Connecting an autonomous Agent Development Kit (ADK) agent to databases, internal APIs, and code execution turns model decisions into production-state changes that system prompts cannot securely constrain. The post presents an open-source Customer Support & Returns Agent built with ADK and Gemini, using an example where prompt injection could produce an unauthorized refund or leak environment secrets. Its zero-trust design combines hardware-backed signing for database mutations, gVisor isolation with no network egress and resource limits for generated Python, and deterministic semantic gateways for prompts, tool calls, and database updates. Local equivalents use HMAC keys, a database ingress verifier, a constrained Docker runner, and Python validation tests, while production mapping uses Cloud KMS, HSM, and VPC Service Controls. The conclusion is that infrastructure-enforced boundaries let the model reason dynamically within strict limits.

## Context

Connecting autonomous agents to live databases, internal APIs, and dynamic code execution allows model-directed actions to mutate production state. The post describes prompt injection, shared database credentials, and unisolated execution as risks that system prompts alone cannot reliably prevent.

## Approach / What changed

The design applies three external security layers: hardware-backed cryptographic signatures for agent database writes, gVisor user-space kernel isolation with no network egress and strict resource limits for generated code, and deterministic semantic gateways that validate prompts, tool calls, database updates, and secret leakage. Local demonstrations use HMAC, a constrained Docker runner, and CI/CD tests, with production mappings to Cloud KMS, HSM, and VPC Service Controls.

## Takeaways

- Each state-changing write is signed by the specific agent, and an ingress guard verifies the signature before committing the transaction; independent scans can detect later ledger tampering.
- Generated Python runs under gVisor with --network=none, all capabilities dropped, a 64 MB memory limit, 0.1 CPU allocation, and a five-second timeout.
- The semantic gateway blocks detected secrets, jailbreak signals, and refund updates outside the order limit, with regression tests checking blocked and allowed cases.

**Tags:** [Agent Development Kit](https://yomu.fyi/topic/agent-development-kit), [AI Agents](https://yomu.fyi/topic/ai-agents), [Google Cloud](https://yomu.fyi/topic/gcp), [Sandboxing](https://yomu.fyi/topic/sandboxing), [Security](https://yomu.fyi/topic/security)

- Source: [Google](https://developers.googleblog.com/build-zero-trust-ai-agents-with-googles-agent-development-kit)
- Source URL: https://developers.googleblog.com/build-zero-trust-ai-agents-with-googles-agent-development-kit
- Ingested by Yomu: 2026-09-09T14:27:36.317Z

[Read original post](https://developers.googleblog.com/build-zero-trust-ai-agents-with-googles-agent-development-kit)