Guardrails, governance, and the build-vs-buy call

Lesson 5 of 5 in Google’s Agent Stack: ADK, Agent Runtime, and the Names That Keep Moving.

Google’s platform gives you two different kinds of guardrail, and people conflate them constantly. Content filters judge text — what the model was asked and what it produced. Semantic Governance Policies judge actions — the tool calls an agent makes. An agent can be perfectly polite while wiring money to the wrong account, which is why the first control cannot substitute for the second.

Content filtering is the older, better-specified half. Gemini’s configurable filters on the platform cover four harm categories — HARM_CATEGORY_HATE_SPEECH, HARM_CATEGORY_DANGEROUS_CONTENT, HARM_CATEGORY_HARASSMENT, HARM_CATEGORY_SEXUALLY_EXPLICIT — each with a blocking threshold you set. Blocked responses come back with finishReason: SAFETY and per-category safetyRatings carrying probability and severity scores, which is the part worth logging: the scores tell you how close your traffic runs to your own thresholds.

Safety and content filters — Gemini Enterprise Agent Platform (checked September 2026)

Thresholds: BLOCK_LOW_AND_ABOVE, BLOCK_MEDIUM_AND_ABOVE, BLOCK_ONLY_HIGH, HARM_BLOCK_THRESHOLD_UNSPECIFIED, OFF, and BLOCK_NONE.

Methods: SEVERITY (the default, using probability and severity scores) and PROBABILITY (probability only).

Defaults move with the model: the docs state that “for gemini-3.5-flash and subsequent models, OFF is the default value”, while the REST reference lists BLOCK_MEDIUM_AND_ABOVE as the default threshold for older models.

Non-configurable filters you cannot switch off block child sexual abuse material (CSAM) and personally identifiable information (PII/SPII); blocked prompts return PROHIBITED_CONTENT, and responses can be stopped with an SPII finish reason. BLOCK_NONE removes automated blocking on the configurable categories but still returns scores.

Which brings us to the newer half. Semantic Governance Policies are, in Google’s own description, “natural language constraints that you configure to govern AI agents through their tool calls,” and they apply to all agents on Agent Runtime. Their meter tells you how they work: one Agent Compute vCPU-hour per 15,000 agent-model response evaluations, plus tokens for the evaluating model, with billing commencing later in 2026.

Read that meter carefully, because it defines both the value and the limit. A model is judging each response against your written rule. That is genuinely powerful — you can express “do not disclose another customer’s data” without enumerating every tool argument that would violate it, which no static policy language can do. It is also probabilistic and priced per evaluation: a judge, not a lock. Put your invariants in the tool contract and in IAM, then use governance policies for the fuzzy, contextual rules that no schema could encode.

Where a rule can bind on Google’s platform

System instructions — weakest guarantee, broadest coverage
The system prompt and safety instructions shape behaviour on every turn and cost nothing to change. They also hold only usually — non-determinism, long contexts, and injected text all attack “usually”. Google’s safety docs include a “System instructions for safety” page precisely because this layer is useful; it is never sufficient.
Content filters — deterministic block on classified text
Four configurable harm categories with per-category thresholds, plus non-configurable CSAM and PII/SPII filters. This layer reliably stops content. It has no opinion about actions, amounts, or recipients — and its defaults vary by model generation.
Semantic Governance Policies — model-evaluated rules over tool calls
Natural-language constraints that govern agents through their tool calls, applied to all agents on Agent Runtime and billed per response evaluation. The right home for contextual rules a schema cannot express — and, being a model judgment, a layer you should monitor with the same suspicion you apply to any LLM judge.
Tool contracts and gates — the model gets no vote
Parameter caps, allowlists, dry-run modes, and approval gates in the tool implementation itself. This is where an invariant belongs: a maximum refund enforced in code cannot be argued out of by any prompt, any injected document, or any model upgrade.
Identity, network, and key boundaries — foundation — infrastructure, not inference
IAM-based agent identity via service accounts you control, Private Service Connect interfaces for private deployment, CMEK, VPC Service Controls, data residency at rest, HIPAA support, and Access Transparency and Access Approval — each documented per service in an enterprise-security matrix that is not uniform across services. Example Store, for instance, was not listed alongside Runtime, evaluation, Sessions, Memory Bank, and Code Execution for VPC-SC, CMEK, and residency at rest. Re-read the live matrix rather than assuming a control covers everything.

Now the decision this whole module exists to inform. You have chosen ADK — that part is cheap and reversible. The expensive question is who operates it, and the honest comparison has five columns, not one.

ADK on Agent Runtime vs ADK on Cloud Run or GKE vs ADK self-hosted anywhere
Dimension	Agent Runtime (managed)	Cloud Run / GKE	Self-hosted, any cloud
Session isolation for model-chosen code	Bought. A managed Sandbox covers code execution, including Computer Use and shell sandboxes.	Yours to design. GKE gives you the primitives, not the isolation guarantee.	Yours entirely — and the single layer teams most often under-build.
State across turns and sessions	Sessions plus Memory Bank, with generated memories, profiles, and revisions.	You can still call the managed services from Cloud Run or GKE — this is a per-service choice, not a package deal.	Your own store, extraction, and retrieval. Portable by construction, expensive by construction.
Agent identity and credentials	IAM-based identity with service accounts, plus Agent Gateway brokering calls and authorization.	IAM still applies; the credential-brokering pattern for tools is yours unless you adopt the gateway.	Your secret store and your own answer to “what identity did that action run as?”
Operations and rollback	Revision and traffic management, Cloud Trace, Cloud Logging, monitoring, Terraform provisioning, bidirectional streaming, PSC interfaces.	Familiar container operations you probably already run — plus wiring your own tracing.	Everything, including the on-call rota that notices a stuck agent at 3 a.m.
Meter and commitment	Agent Compute, Agent Memory, Agent Storage, plus operations and gateway units; idle between turns not billed; savings plans available.	Standard container pricing plus whichever managed services you opted into.	Your existing infrastructure bill, plus engineering time nobody meters.
Exit cost if you leave	Agent code travels; memory record shape, gateway policy, and trace format do not. Budget for a data migration, not a rewrite.	Low — a container contract is portable, and you likely already have one elsewhere.	Zero by design. You paid it up front instead.
Honest fit	Teams whose scarce resource is platform engineers, and who need session isolation, memory, and audit now.	Teams with strong container operations who want managed state without managed hosting — often the pragmatic middle.	Teams with a mature platform, hard residency or multi-cloud constraints, or a genuine reason to own the sandbox.

What to re-check before you commit — a standing checklist

This module is educational material about platform shapes, not vendor documentation. Before any design review, check five things yourself, because all five moved inside the twelve months before this was written:

The names. Product page titles, doc banners, and which brand the runtime lives under this quarter.
The launch stages. The overview page does not print GA versus preview; check per feature, and treat “Experimental” on ADK’s A2A support as a schedule risk.
The enterprise-security matrix, cell by cell. It is not uniform across services.
The prices and their commencement dates. Several meters started billing during 2026, and one storage rate was published two ways.
Deprecations. Vertex AI Extensions shuts down after 26 November 2026. Something else will have a date on it by the time you read this.

Tool: Cloud Deployment Wizard — Walk your own agent through the deployment decision — managed runtime, container, or self-hosted — and see which layers you just signed up to build.

Interactive flashcard deck.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.