S-2026-07-28-gemini-managed-agents

Google — Gemini API Managed Agents: environment hooks, budget controls, triggers (July 2026)

Tag: S-2026-07-28-gemini-managed-agents Type: article (primary vendor product announcement, Google’s own blog, fetched in full) Author(s): Philipp Schmid (Member of Technical Staff, Google DeepMind), Mariano Cocirio (Product Manager, Google DeepMind) Date of source: 2026-07-28 Date ingested: 2026-08-11 Authority weight: medium — primary and unambiguous on what shipped, but self-interested on what it does; the one customer quote is vendor-selected; no independent test cited Raw file: /_raw_sources/S-2026-07-28-gemini-managed-agents.md

What it claims

Google announced four additions to Managed Agents in the Gemini API (agents that run autonomously in Google-hosted, isolated Linux sandboxes, coordinating reasoning, code execution, package installation, file management and web retrieval from a single API call). First, environment hooks: deployers drop a .agents/hooks.json into the sandbox and the runtime executes their custom scripts on pre_tool_execution or post_tool_execution events for every tool call, with regex matchers targeting specific tools or everything. A pre-execution hook returning {"decision": "deny", "reason": ...} skips the tool call and feeds the rejection reason back into the model’s context; hooks can also POST to external HTTP endpoints. The stated use pattern is to “block, lint, or audit tool calls inside the sandbox”. Second, budget controls: a max_total_tokens cap on total consumption (input + output + thinking); on reaching it the agent “safely pauses”, returns status: "incomplete" with environment state preserved, and can be resumed with a fresh budget. Third, scheduled triggers binding an agent, environment, prompt and cron schedule into a persistent resource, with sandbox files persisting across runs. Fourth, an Environments API to list, inspect and delete sandbox sessions programmatically (default sandbox TTL is 7 days). The default model moved to Gemini 3.6 Flash, and managed agents became available on free-tier projects. One customer is quoted: OffDeal, a self-described “AI-native investment bank”, whose CTO explains that before hooks “the sandbox is remote, so our validation code had nowhere to run”, and that a post-execution hook now runs their quality-verification pipeline inside the sandbox, publishing “a manifest of approved files that are the only images allowed into the deck”. Google’s closing framing: the updates make managed agents “cost-controlled, scheduled workers that operate autonomously… without breaking your budget or requiring external orchestration”.

Notable quotes

• “New environment hooks let you block, lint, or audit tool calls inside the sandbox.” (summary line)
• “If the script returns {"decision": "deny", "reason": "..."}, the tool call is skipped and the rejection reason is passed into the model’s context.” (hooks section)
• “To prevent runaway tasks, you can pass max_total_tokens… execution safely pauses and the interaction returns status: "incomplete".” (budget controls)
• “Before agent hooks, we couldn’t do this on Gemini’s managed agents: the sandbox is remote, so our validation code had nowhere to run.” (Alston Lin, Founder & CTO, OffDeal)

What’s speculative vs. asserted

Asserted (Google’s own, primary): the four capabilities, their mechanics as documented, the 28 July date, free-tier availability, and the model default change. None of it is independently verified here — no benchmark, no third-party assessment, and the OffDeal account is a vendor-selected customer quote. Absent rather than speculative: the post names no regulatory standard and makes no compliance, governance or assurance claim of any kind — every governance read-across attached to this source elsewhere in the vault is the vault’s own inference, marked [inference]. The post does not specify: whether hook execution and deny decisions are themselves logged immutably, who can alter .agents/hooks.json at runtime, or any retention/evidence model for hook outcomes.

Topics this feeds

• AI Governance Platforms — first in-window item from the cloud-native cohort in ~6 weeks; supplies a first-party hook surface data point to the agent-harness enforcement locus (the very surface third-party enforcement vendors like HiddenLayer and Credo AI depend on, and whose limits HiddenLayer concedes cap its enforcement).

Open questions raised

• Hooks put the deployer’s control logic inside the provider’s sandbox. Where does the evidence of a deny decision live, who retains it, and would it satisfy EU AI Act Art. 12-style record-keeping or SS1/23 monitoring expectations? Not addressed by the source. [inference]
• If the platform’s native hook surface expands, does the ceiling HiddenLayer concedes (“strongest enforcement each platform supports”) rise for third-party harness-security vendors — or does first-party tooling displace them? Not addressed by either source. [inference]
• A max_total_tokens pause is a cost control; the source does not claim it as a safety kill-switch. Whether budget exhaustion semantics (pause-and-resume with state preserved) are acceptable as a human-oversight mechanism under Art. 14-style expectations is untested. [inference]