Show: Governing AI Agents on GCP — GKE, Vertex AI, Workload Identity Bridge

[imran-siddique]

Govern Your AI Agents on GCP — GKE, Vertex, Workload Identity

The Agent Governance Toolkit runs natively on Google Cloud with zero vendor lock-in. Here's the full integration surface.

🏗️ Deploy on GKE in 4 Steps

# Build, push to Artifact Registry, deploy
gcloud auth configure-docker us-central1-docker.pkg.dev
docker build -t agt-governance .
docker tag agt-governance us-central1-docker.pkg.dev/PROJECT/agt/agt-governance:latest
docker push us-central1-docker.pkg.dev/PROJECT/agt/agt-governance:latest
kubectl apply -f agt-deployment.yaml

The deployment YAML runs AGT as a sidecar alongside your agent pod — same pattern as Istio. Full config in the GCP GKE deployment guide.

🤖 Govern Google ADK Agents

AGT includes a native Google Agent Development Kit (ADK) adapter. Wrap your ADK agent's tool calls with policy evaluation:

from agentmesh import PolicyEvaluator

evaluator = PolicyEvaluator.from_yaml("policies/adk-agent.yaml")

# Before any tool call
decision = evaluator.evaluate(action="vertex:generate_content", context={"model": "gemini-2.0-flash"})
if not decision.allowed:
    raise PermissionError(decision.reason)

The full Google ADK governed example shows trust-gated tools, capability scoping, and audit trails with ADK agents.

🔑 Workload Identity ↔ DID Bridge

The GCPManagedIdentityAdapter maps AGT agent DIDs to GCP Workload Identity. Governed agents acquire GCP tokens using their mesh identity — no service account key files:

from agentmesh.identity.managed_identity import GCPManagedIdentityAdapter

adapter = GCPManagedIdentityAdapter(
    service_account="agent@project.iam.gserviceaccount.com"
)
token = adapter.acquire_token(agent_did="did:mesh:my-agent")

📊 Enterprise GCP Stack

GCP Service	AGT Integration
GKE	Governance sidecar deployment (Helm chart)
Cloud Run	Lightweight serverless deployment
Vertex AI	Policy-gated model invocations
ADK	Native agent governance adapter
Workload Identity	DID → GCP identity bridge
Cloud KMS	Ed25519 key storage and rotation
Cloud Monitoring	Prometheus metrics export
Cloud SQL	Audit log persistence (PostgreSQL)

📚 Full Docs

• GCP GKE Deployment — GKE in 4 steps
• GCP Production Guide — Workload Identity + KMS + HA
• Google ADK Integration — Governed ADK agents
• Quick Start — pip install agentmesh-platform

---

AGT is pure Python, MIT licensed, and cloud-agnostic by design. It works identically on GCP, AWS, and Azure. Try it out and share your feedback! 🚀