Google Cloud launches AI agent engine & governance

Google Cloud has launched Agent Compute Engine for AI agents, based on the infrastructure it uses to run Gemini for work tasks.

The launch also expands Google Cloud's agent governance tools to cover agents running across its own cloud services and other environments.

Agent Compute Engine is a compute service for autonomous software agents that write and execute code, run tools, use browsers and manage workflows over extended sessions. It gives each agent its own micro virtual machine to handle large numbers of concurrent sessions while keeping workloads separated.

The product emerged from the demands of operating Gemini at scale, where agents repeatedly start, pause and resume as they interact with users and external systems. It uses copy-on-write memory sharing and snapshot-based pause-and-resume functions so idle sessions do not continue consuming full computing resources.

Google Cloud also outlined the service's security model. Agent Compute Engine runs with Titanium, its infrastructure processing unit architecture, and places each microVM behind a hardware-isolated hypervisor boundary with its own kernel and root access.

Each agent session receives its own identity and short-lived credentials. Those credentials are injected outside the microVM, and each instance has a cryptographically verified ID.

For longer-running tasks, every microVM can use its own Hyperdisk storage so agents can retain workspace state and context between sessions. This is intended to let agents access enterprise systems and data under the same identity and audit controls used elsewhere in Google Cloud.

"Scaling the Gemini agent to planet scale requires compute that spins up rapidly and operates with extreme efficiency. Agent Compute Engine microVMs give us the responsiveness, hardware isolation, and workload density needed to deliver interactive agent sandboxes to our users around the world," said Gautham Thambidorai, VP & Google Fellow, Gemini.

GKE option

Alongside the managed service, Google Cloud introduced Agent Substrate on Google Kubernetes Engine, an open-source execution runtime for teams that want more control or already use Kubernetes. The software is aimed at platform teams that need customisation or multi-cloud portability.

Agent Substrate separates agent execution from machine management and returns machines to a shared pool when agents become idle. The runtime can later restore the session when needed.

In benchmark tests involving 200,000 agents, the system showed 500 activations per second with suspend-and-resume latency below 500 milliseconds. Google Cloud said it can also deliver up to 10 times the compute density of more traditional approaches while maintaining kernel isolation and identity-based network security for each agent.

The runtime can operate with either microVMs or gVisor sandboxes and can run on any Kubernetes cluster. It supports frameworks including Claude Code, OpenClaw and Hermes.

Nous Research is among the early users cited by Google Cloud.

"We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control. Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources. Our experience with Agent Substrate gives us confidence the architecture can scale efficiently as agent workloads grow," said Bizira.

Governance push

The broader announcement also extends governance features within Gemini for business. As enterprises move from pilot projects to production deployments, Google Cloud said they face rising risks around data exposure, access control and auditability as agent numbers increase across multiple runtimes.

The framework includes Agent Gateway for policy enforcement and traffic control, Agent Registry as a record of approved agents and tools, Agent Identity for assigning secure identities to agents, and observability tooling based on OpenTelemetry standards.

Google Cloud is extending these controls across Agent Runtime, Cloud Run, Agent Sandboxes in Gemini platform, Google Kubernetes Engine and Agent Compute Engine. It is also preparing policy enforcement for cross-cloud and hybrid environments through Envoy proxy-based deployment points, along with local governance for endpoint-based coding agents running on managed devices.

New governance functions due in preview include token and cost controls, model routing policies, extension bindings for integrations and delegated user authorisation through identity partners including Ping Identity, SailPoint and Saviynt. Google Cloud also announced Express Link for Cloud Run, intended to simplify authenticated links between agents and tools.

L'Oréal is using the governance framework in its internal platform for agentic AI, according to Google Cloud.

"At L'Oréal, our ambition is to put agentic AI in the hands of our teams, empowering them to bring new ideas to life and shape the future of beauty. Through our Beauty Tech Agentic Platform, AI agents are becoming part of everyday work. Google Cloud's agent governance provides us the foundation to scale this ambition with confidence, unifying identity, policy and observability across runtimes such as Cloud Run. Our developers can innovate faster while we maintain clear control over what each agent can access," said Frizzo.