5.0 Domain 5 Roadmap: Security and Governance (15% Weight)

Core Architectural Topics in Domain 5 (~15%)

1. Perimeter Defense with Agent Gateway & Model Armor (Module 5.1)

Screen prompts and responses for prompt injection and PII (single SDP match = redact; multi-detector violation = block), enforce Org Floor Settings, and know A2A/MCP scanning rules.

2. Managed Agent Identity, PAB, IAM & OAuth 2.0 (Module 5.2)

Isolate agents with verifiable Agent Identities, bound eligibility with Principal Access Boundaries (PAB), apply IAM Deny/Allow, and stop Confused Deputy attacks via OAuth 2.0 Auth Manager.

3. Deterministic ADK Callbacks & HITL Patterns (Module 5.3)

Intercept model requests (before_model_callback returning LlmResponse) and tool parameters (before_tool_callback returning dict), and distinguish Tool-Level HITL from CES Live-Agent Handoff.

4. Enterprise Fleet Governance: ADC, App Hub & Agent Registry (Module 5.4)

Standardize pre-deployment blueprints in Application Design Center, map ownership in App Hub, and catalog A2A Agent Cards and MCP servers in Agent Registry.