Google Cloud announced a Gemini agent on October 8 that works under its own identity, runs inside a sandbox behind a policy firewall, and stops when a project hits a spend cap. Google gave no price and no general availability date for it. Buying committees can evaluate the controls now, and have nothing yet to put in a budget.
What Google announced
The announcement came from Thomas Kurian’s keynote at Gemini at Work 2026, published on the Google Cloud blog. It describes a single agent, reachable from one prompt box and one API, that answers questions, writes and runs code, and produces finished documents. Google also lets it spin up temporary sub-agents for parallel and sequential steps that can run for hours or days.
Two design choices matter more to a CIO than the feature list. The first is that the agent and the model are separate purchases. Google’s post says “the model underneath it is a separate choice,” and states that the agent orchestrates across Gemini models and Claude models from Anthropic today, with other private and open models planned. The second is that agents carry identities. Google says each agent gets an identity that is cryptographically attested and “governed like an employee, with least-privilege permissions,” and that coworker agents get their own @agents.company.com email address and persistent storage.
The governance layer, as Google describes it
Google frames agent governance as four questions: who the agent is, what it may do, what it did, and what it should never touch. The answers it lists are an identity per agent, role-based permissions approved by security administrators, an audit trail attributed to the agent rather than to a person, and an Agent Gateway. Google describes the gateway as an AI network firewall, and its example policy reads “agents may not open documents classified Need to Know.” Google says the policy is written once and applied to every agent in the company.
The audit-trail detail is the one that changes operations. If an agent’s actions are logged under the agent, an incident review can separate what the system did from what an employee asked it to do. That is the question the buying committee will be asked after the first bad outcome, and most current deployments cannot answer it cleanly. Our earlier piece on enterprises that cannot say how many agents they are running covers the inventory problem that identity-per-agent is meant to solve.
The spend cap pauses the agent
The cost controls are the most concrete part of the post. Google says an administrator can set a hard limit on a project’s AI spend in the Cloud Billing Console, that Gemini monitors token usage and sandbox costs, and that when a cap triggers, the project’s agent pauses and work resumes with a single click in the console. Tracking is per project, which Google says supports departmental chargebacks. A routing feature it calls Smart Routing sends each workload to the model that gives the lowest cost for the needed performance.
The pause behavior has a consequence for long-running work. Google positions the agent for jobs that last hours or days. A cap sized for a typical day will stop a job midway through a month-end close or a research run, and someone has to be on call to click resume. Caps work as a budget control only if the committee sets them per workflow and names the person who owns the resume decision. Google’s post does not say whether a paused job keeps its state, so that is a question for the vendor before any pilot.
What independent analysts said
Two analysts quoted by CIO.com read the announcement differently from Google. Carmi Levy, an independent technology analyst, told the outlet that Google is not trying to prove its models are better, and is instead positioning itself as the gatekeeper of the new enterprise operating system, powered by whatever model makes sense. He said Google is “arguably leading the conversation around identity, audit trails, and who, or what, is ultimately responsible for workflows,” while noting that OpenAI and Microsoft have made similar claims.
Mahmoud Ramin, a research director at Info-Tech Research Group, said the announcement does not create a new category, because OpenAI, Anthropic, Microsoft and Meta already position multiagent capabilities in their platforms. He said the focus for any platform choice should be who controls AI agents. Both readings are in CIO.com’s report on the launch.
Levy’s point about gatekeeping is the strategic one. A model-agnostic agent keeps your context, skills and data in Google’s layer while the model underneath changes. That is useful if the model market keeps shifting every few months, as Google says it does. It also moves the switching cost from the model to the agent platform.
What it means for the buying committee
Google’s post cites customer results, including Bradesco cutting document review from one hour to five minutes and Commerzbank cutting document question answering from 20 hours to one. Those figures are self-reported by Google and its customers, and the post does not show the baseline or how much of the freed time reached a budget line. Our recent piece on why a saved hour is not saved money explains how to discount numbers of this kind before they go into a business case.
Three actions follow for a CIO or chief AI officer whose organization runs on Google Workspace.
- Ask Google for pricing, the general availability date, and the list of regions and compliance certifications for the Gemini agent. The post states none of them, and the industry editions for financial services and legal are described as in preview.
- Test the identity and audit claims against your own incident process. Ask whether an agent’s @agents.company.com address can be revoked, reviewed and reported on the way a contractor account is.
- Write spend-cap policy per workflow before piloting, and decide who resumes a paused agent.
Committees running Microsoft 365 or Slack should note that Google says the agent reaches both, so the evaluation is not limited to Google shops. The Agent Gateway and sandbox, though, sit in Google’s cloud, which is where the lock-in question belongs.
The announcement shows where vendor competition has moved. The model is now a line item inside an agent platform, and the controls around identity, audit and spend are the part a buyer can compare today. Ask each vendor for the same four answers Google offered: who the agent is, what it may do, what it did, and what it must never touch.
Source: Google Cloud Blog
