What happened
On Oct 8 Google Cloud announced the Gemini Enterprise Agent Platform including Agent Gateway, an Envoy/Kubernetes-based 'AI network firewall' (in preview) that natively parses MCP and A2A protocols to enforce tool-level RBAC, agent identity (SPIFFE/mTLS), and integrates with Model Armor for prompt-injection/data-leak protection; it also introduced Threat Hunting and Detection Engineering security agents (preview) plus three new security agents.
Why it matters
First major cloud provider to enforce agentic security at the protocol layer (parsing MCP tool calls and A2A agent messages) rather than the network layer — directly addressing prompt-injection and MCP tool-governance gaps. It lands inside Gemini Enterprise, which nearly 90% of the Fortune 100 use, so it defines the default control plane for a large installed base.
Applicability
Enterprises running or planning Gemini Enterprise/Gemini agent workloads should evaluate Agent Gateway in preview now and plan protocol-layer governance policies (MCP tool allowlists, IAP authz) as it heads to GA.