Executive Summary

Four numbers capture both the scale and the boundary of the announcement: the breadth of models the platform reaches, the short lifespan of the certificate that backs the ID, the time it took a competitor to ship the same answer, and the control layer still left to the underlying data source.

Until now, the way an agent reached data inside a company was usually a single one. Many agents shared one human-created service account and borrowed its broad permissions wholesale. When something went wrong and you opened the logs, all you found was the name of the shared account. Exactly which agent touched what was hard to reconstruct after the fact.

Agent Identity in the Gemini Enterprise Agent Platform inverts this. Every agent an administrator deploys receives a unique cryptographic identifier of the form spiffe://TRUST_DOMAIN/resources/SERVICE/RESOURCE_PATH. SPIFFE is an open specification that standardizes identity between services; here it is used to pin an unforgeable name tag to a software actor rather than a person. Unlike a shared account, it cannot impersonate another identity, and no long-lived keys are issued.

That identifier goes straight in as the principal of an IAM policy. An administrator can write "this permission, to this agent only" directly onto a resource such as a GCS bucket or a BigQuery dataset. Exactly as least privilege is applied to a person, the access scope is narrowed for each individual agent. On the credential side, an X.509 certificate that auto-rotates every 24 hours is issued and cryptographically bound to the access token over mTLS. Steal the token alone, and you cannot replay it.

Read this announcement as mere product news and you miss half of it. Where Google pulled out an ID, an old question was already waiting. Pebblous has pointed at that same spot three times over recent months. In order: the problem of an autonomous enterprise handing agents the ledger without giving them employee numbers; the problem of retrieval copying rather than inheriting the source's permissions; and the problem that memory piled up without a name tag cannot later be erased.

All three were "raising the problem." This piece is different in kind. The industry has begun to answer that gap with actual implementations, and pulling one answer apart shows where the lock holds and where it is still open. The table below sorts out which axis of those three earlier pieces this announcement answers.

One sentence runs through all three. No name tag, no control. If you don't know who touched something, you cannot narrow the permission, retrace the incident, or erase the data that got in by mistake. Agent Identity is the first commercial-grade attempt to carve that name tag into the actor layer itself.

An ID alone does not end control. Google set up two more gates on top of identity. The first is the Agent Gateway, a control tower guarding the space between agents and tools (MCP servers and the like). It filters which agent may call which tool, at the granularity of the tool name and of whether the call is read-only or allowed to write. Model Armor, which blocks prompt injection and data exfiltration, also attaches to this path.

The second is delegated access. When an agent acts on a user's behalf, it uses not its own permissions but an OAuth token delegated from the user. The Agent Identity Auth Manager brokers and encrypts the credential so the agent cannot look at the original credential directly. Logs left along this path stamp both the agent ID and the user ID. "Who ordered it, and who carried it out" ends up on a single line.

On top of this come the Agent Registry, which gathers approved agents, tools, and skills in one place; Agent Threat Detection, which catches reverse shells and malicious IP connections in real time; and Agent Anomaly Detection, which flags abnormal reasoning using statistical models together with an LLM judge. Taken together, "who" (identity) and "which tool is this agent entitled to call" (the tool gate) are firmly locked. To this point, it is clear progress on the audit question Pebblous has been posing.

The phrase "the industry's first commercial answer" should be used with care. Google was an early case of nailing identity down into commercial infrastructure, true, but it is not the world's first or the only solution. In the same month, competitors laid down their answers side by side.

• • Okta for AI Agents — GA on April 30, 2026, eight days after Google. Its Cross App Access (XAA) protocol standardizes the flow where an agent reaches several downstream services on a user's behalf.
• • Auth0 Auth for GenAI — developer preview in May 2026. It treats MCP and autonomous agents as first-class identities and integrates with LangChain, LlamaIndex, the Vercel AI SDK, and more.
• • WorkOS — positions itself as a lightweight alternative to Okta and detects non-human identities with a dedicated tool.

That the direction overlaps is itself a signal. The Cloud Security Alliance (CSA) diagnosed the gap in non-human identity governance as coming not from a lack of technology but from no one deciding where responsibility sits. Indeed, CSA put at nine in ten the organizations that lack a reliable way to govern what an agent does in production. That several vendors reached for identity first in the same month means the gap has become a hands-on problem that can no longer be deferred. So it is more accurate to read this announcement not as "a problem Google solved alone" but as "the flagship case of a problem the industry began answering all at once."

Here we have to pull the previous report's question back out. A vector index stores the source document chopped into small pieces, and in that process the row- and column-level permissions the source held (like BigQuery's row-level security) do not come along. Because the permission is copied rather than inherited, even someone barred from the source can see the content through the chunk left in the index. This is the failure point Pebblous has called entitlement drift.

So did Agent Identity solve that point? Judging by the published documentation, the answer is "only partly." The Agent Gateway is the layer that controls "which agent may call which tool," not the layer that controls "which rows and columns of the data that tool returns the agent is entitled to see." The Gateway docs show no mention of row/column-level access control or of fine-grained permission enforcement at the vector-index level. The RAG Engine docs speak of data-lineage tracking, hygiene, and region-residency requirements, but there is no evidence they explicitly solve the problem of an index losing the source's permissions.

The answer splits by path. Run retrieval on the user's behalf through delegated OAuth, and the underlying data source's native security applies that user's original permissions as they are. In this case entitlement is preserved. Conversely, if the agent runs RAG on its own permissions, it ends up depending on "who attached which ACL metadata to that index." Someone has to reconcile the permissions of the vector index and the source system by hand. Unlike identity and the tool gate, which came down into the infrastructure, data permission at retrieval time still passes through an operator's hands.

So split the audit question "who touched what data" into two pieces and the state becomes clear. The leading "who" was, this time, turned into infrastructure all the way up through the identity and tool layers. The trailing "what data was it entitled to touch" is preserved automatically only on the delegated path; outside it, it still hangs on name-tag management at the data layer. One more step remains.

Google Official Announcements & Docs

• 1.Google Cloud. (2026). "Introducing Gemini Enterprise Agent Platform." Google Cloud Blog.
• 2.Google Cloud. "Agent Identity overview." Google Cloud Docs.
• 3.Google Cloud. "Use Agent Identity with Agent Runtime." Google Cloud Docs.
• 4.Google Cloud. "Agent Gateway overview." Google Cloud Docs.

Competitor Responses

• 5.Okta. (2026). "Okta for AI Agents: General Availability." Okta Blog.
• 6.Auth0. (2026). "Securing Gemini Enterprise Agent Platform Runtime." Auth0 Blog.

Industry Diagnosis

• 7.Cloud Security Alliance. (2026). "AI Agent Identity Crisis: Standards Emerge as Enterprises Lag." CSA Research Note.
• 8.aiagentstore.ai. "This week in AI agent news."