5.5 Section 5 Master Takeaway: Security & Governance Architecture Summary

1. Interactive Security Architecture Switcher: Top 3 Design Pitfalls

Click each scenario below to compare common security anti-patterns against the recommended Google Cloud architecture:

Why the Naive Design Fails

Allowing raw credit card numbers into Gemini prompts violates PCI compliance; assuming Model Armor scans MCP tools/list discovery metadata leaves unvetted MCP tool descriptions uninspected.

The Winning Architectural Fix

Use Agent Gateway + Model Armor (Single SDP match = redact inline & identify user via out-of-band OAuth 2.0 session context; Multi-detector match = Hard Block), and vet MCP servers centrally in Agent Registry!

2. The 4-Pillar Security & Governance Summary

5.1 Perimeter Defense

Gateway & Model Armor

Single SDP match = redact inline. Multi-detector match = hard block. Gateway IAM = calloutUser + user. Scans A2A & MCP tools/call (bypasses MCP tools/list).

5.2 Zero-Trust Identity

Identity, PAB & OAuth 2.0

1 Agent = 1 Managed Agent Identity. Cure Confused Deputy with OAuth 2.0 Auth Manager. Policy order: 1. PAB (Eligibility) -> 2. IAM Deny -> 3. IAM Allow.

5.3 Runtime Callbacks

ADK Hooks & HITL

before_model_callback returns LlmResponse (skips LLM, $0 cost). before_tool_callback returns dict (skips tool, triggers Tool-Level HITL).

5.4 Fleet Governance

ADC, App Hub & Registry

ADC = pre-deploy hardened templates. App Hub = owner, criticality & outage topology. Agent Registry = central A2A/MCP catalog & semantic routing metadata.

3. Master “If You See X, Pick Y” Decision Matrix (Section 5)

Architectural Requirement / Scenario	Recommended Google Cloud Solution	Anti-Pattern to Avoid
Mask a single credit card number in a prompt while allowing the refund lookup to proceed	Model Armor with SDP (redacts inline) + Out-of-Band OAuth 2.0 Session Identity (or SDP Surrogate Token) for tool lookup.	Blocking innocent single-PII prompts or passing raw PAN digits to the LLM.
Enforce a non-negotiable minimum safety threshold across all projects in an Organization	Model Armor Floor Settings at the Organization or Folder node.	Relying on individual project owners not to edit local templates.
Prevent an agent from being tricked into modifying User B’s records on behalf of User A	Agent Identity Auth Manager with OAuth 2.0 User Delegation.	Authenticating user-specific tool calls with the agent’s shared service account.
Ensure a Support Agent can never access R&D folders even if granted an IAM Allow role	Principal Access Boundary (PAB) policy bound to the Support Agent’s identity.	Relying solely on periodic manual IAM audits.
Skip calling Gemini and return a verbatim legal notice at zero token cost	`before_model_callback` returning an `LlmResponse` object.	Returning a `dict` from `before_model_callback` or relying on system prompt instructions.
Pause a `refund(amount=2500)` call for supervisor approval before the API executes	`before_tool_callback` returning a Python `dict` (Tool-Level HITL).	Attempting to inspect JSON tool arguments inside a Cloud IAM policy condition.
Standardize pre-deployment security blueprints vs. map outage ownership vs. catalog MCP tools	ADC (Pre-Deploy Blueprints) + App Hub (Ownership/Criticality) + Agent Registry (A2A/MCP Catalog).	Mixing up Pre-Deployment (ADC) with Runtime Discovery (Agent Registry).