skills.rest
google
googleOFFICIAL
Explore all skills by this author →
Website𝕏@GoogleOSSGitHub

google-cloud-solution-multi-agent-security

Designs and configures Google Cloud Agent Gateway ingress and egress security policies.

19.1k|1.5k|Updated Mar 31, 2026
Search Tags:#mcp#Google Cloud#iap#egress#agent gateway#Model Armor#multi-agent security
One-click install
npx skills add https://github.com/google/skills --skill google-cloud-solution-multi-agent-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: google-cloud-solution-multi-agent-security
Source: https://github.com/google/skills/tree/main/skills/cloud/google-cloud-solution-multi-agent-security
Command: npx skills add https://github.com/google/skills --skill google-cloud-solution-multi-agent-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires vertexai, requests, google-adk, and includes scripts (resource) and assets (resource) components.

What problem does it solve?

Securing multi-agent systems on Google Cloud requires coordinating Agent Gateways, Model Armor guardrails, IAP authorization, and Private Service Connect networking, which involves many error-prone configurations across gcloud, Terraform, and YAML policies.

Core Features & Use Cases

  • Dual Ingress/Egress Architecture: Generates CLIENT_TO_AGENT and AGENT_TO_ANYWHERE gateway configurations with Model Armor, AuthzPolicy, and Agent Registry integration.
  • Guardrail Policy Generation: Produces ready-to-use YAML/JSON files for Model Armor filters, Semantic Governance Policies, and IAP CEL conditions.
  • Deployment & Validation Scripts: Provides gcloud CLI deployment sequences, Python egress verification scripts, and troubleshooting fixes for 403 errors.
  • Use Case: A platform engineer needs to route three Cloud Run MCP tool services through an egress Agent Gateway with IAP-based per-agent authorization; the Skill generates the gateway config, registry commands, IAM bindings, and SDK deployment script.

Quick Start

Ask the agent to design a secure multi-agent architecture on Google Cloud with an ingress Agent Gateway protected by Model Armor and an egress gateway enforcing IAP policies for MCP tool calls.

Frequently Asked Questions about google-cloud-solution-multi-agent-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure multi-agent traffic with Google Cloud Agent Gateway?▼

Deploy an ingress Agent Gateway with governedAccessPath CLIENT_TO_AGENT fronted by Model Armor, and an egress gateway with AGENT_TO_ANYWHERE routing through a PSC network attachment. Attach an AuthzPolicy with action ALLOW and bind roles/iap.egressor to agent identities.

How to configure Model Armor guardrails for AI agents on Google Cloud?▼

Create a model-armor-config.yaml with piAndJailbreakFilterSettings and sdpFilterSettings, both set to filterEnforcement ENFORCE. Enable modelarmor.googleapis.com before attaching policies, or filters will fail to attach to the gateway.

Why does Agent Gateway egress return 403 errors?▼

Egress 403 errors usually mean missing roles/iap.egressor IAM bindings on the agent identity, a malformed principal ID, or a CEL condition that does not match the tool metadata. Apply the bindings with gcloud beta iap web set-iam-policy.

Can I verify Agent Gateway egress policies with curl?▼

No, egress verification requires a Python script that sends JSON-RPC tools/call requests with an identity token, because egress gateways depend on runtime SDK lifecycle handling and JWT context that curl cannot simulate.

Does Agent Gateway egress support self-signed TLS certificates?▼

No, Agent Gateway egress does not natively trust self-signed certificates or private enterprise CAs. You must use publicly trusted TLS certificates signed by a recognized Certificate Authority such as Let's Encrypt.

What are the limits of Agent Gateway authorization policies?▼

An Agent Gateway supports at most 4 custom authorization policies attached concurrently. Consolidate authorization rules within this limit when designing your security posture.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.3k

enabling-lambda-vpc-internet-access

Provision NAT gateway infrastructure to enable outbound internet access for Lambda functions in VPC private subnets.

Official
Advanced
MattMaggMattMagg
3

ADK Production

Deploy and operate ADK agents on Vertex AI Agent Engine, Cloud Run, and GKE.

Community
Advanced
clawperatorclawperator
2

com.test.agent-skill-result

Generate deterministic SkillResult payloads for agent testing fixtures.

Official
Intermediate
tomztomz

gcp-networking

Automate Google Cloud VPC, subnet, firewall, and edge service configuration.

Community
Intermediate