Google Just Built AI Agent Guardrails Into the Gemini API

Google expanded Managed Agents in the Gemini API today with checkpoints that can inspect and block an agent's actions before they happen, hard spending limits, and schedules that run agents unattended.^[1] Mentions of the new release ran at roughly double their typical volume in the hours after the announcement.

It would be easy to skim this as a feature list. It is worth stopping on, because it takes the two hardest problems in running AI agents unattended, actions you did not approve and costs you did not expect, and moves both from "someone should watch for that" to configuration the platform enforces every time.

That is the real story here: agent oversight becoming architecture instead of vigilance, and the competitive fight among AI platforms moving from the models to the harnesses that run them.

What did Google add to Managed Agents in the Gemini API?

Managed Agents, Google's service that runs an AI agent inside a protected cloud workspace, gained five things: checkpoints that apply your rules to every action the agent takes, hard spending limits, scheduled unattended runs, better workspace management, and free-tier access, with a newer, faster Gemini model as the default.^[1]

The checkpoints are the headline. You write a rule once, and the platform applies it at two moments of every action the agent takes: just before the agent acts, and just after.

The before-the-action check is the one that changes the risk math. It can look at what the agent is about to do (run code, change a file) and refuse it. The action simply never happens, and the agent is told why, so it can take a different route. Unite.AI's framing was blunt and accurate: Google now lets teams block an agent's actions before they run.^[2]

The spending limit is just as concrete. Set a ceiling and the platform enforces it: when the agent hits the number, work pauses safely with nothing lost, so a runaway agent stops at a cost you chose instead of a bill someone discovers later.

Schedules turn an agent into a standing worker. The same job, the same rules, running on your calendar with no one at the keyboard.

All of it now runs on the free tier, per Google's announcement.^[1] The rollout has the usual seams (the new model is in the API before it reaches Google's own command-line tooling for some enterprise users), but the shape is unmistakable.

Why do agent hooks and budget caps matter?

Because human review of agent actions is failing, measurably. Hooks and caps take the checks a person was supposed to perform and hand them to infrastructure that performs them on every action, identically, forever. A rule the platform enforces cannot be skipped on a busy day.

We walked through the evidence last week: across five 2026 studies, the human review loop is failing four ways at once, going unstaffed, getting deceived, getting skipped, and grinding reviewers down. That analysis concluded that oversight has to be built as architecture, not vigilance.

Google just shipped that conclusion as a product. A checkpoint is not a person watching an agent; it is a rule that fires on the ten-thousandth action at 3 AM exactly as it fired on the first. The oversight that works is the kind you cannot forget to do.

Read that sentence closely. It does not promise smarter agents. It promises governed ones: bounded cost, scheduled execution, actions subject to rules. That is the language of infrastructure, and it is what putting agents on real recurring work has been waiting for.

Does this matter if you don't use Gemini?

Yes, as a signal. Hooks, budget caps, and schedulers are features of the harness, the software that wraps and runs an agent, not features of the model. Every serious agent platform is converging on them, and Google just made them free-tier table stakes.

Anthropic's tools have had blockable checkpoints for some time, and OpenAI has been turning agents into metered, billed products. What changed today is the floor: when checkpoints and spending ceilings come free with the platform, shipping an agent platform without them starts to look like a decision.

The harness is where the lock-in now accumulates. Better models were already losing to worse tools: the harness is where teams pile up switching costs, and your rule files, spending caps, and schedules are exactly that. They encode your risk decisions, they are written against one vendor's shape, and they do not port.

It also extends a wider pattern. Pre-tool blocking is a direct mitigation for the lethal trifecta that makes agentic workflows exploitable by design, and it lands a day after the industry's agent-security tooling consolidated at the platform layer. Everywhere you look, the controls around agents are moving down the stack, out of team habits and into infrastructure.

What should you demand from any agent platform now?

Three things, whatever vendor you run: checkpoints that can block an action rather than just record it, spending ceilings the platform enforces rather than your own code, and unattended runs that carry the same guarantees as a supervised session. After today, all three are reasonable asks.

• Checkpoints that block. A log tells you what the agent did. A checkpoint decides what it may do. Only the second is a control.
• Ceilings the platform holds. A budget your own software enforces dies when your software fails. A cap the platform enforces survives every failure above it, including the agent's.
• Schedules with the same rules. An agent running unattended at night needs the identical checkpoints and caps it had while you were watching. Anything less is a second, weaker platform.

What the new controls do not do matters just as much. Checkpoints govern the agent's actions, not the quality of its work; a spending cap bounds cost, not correctness. An agent can stay inside every rule and still be confidently wrong, so gating the work on evidence is still your team's job, and judgment is still the product.

The era of trusting a human to watch the agent is ending. Not because people got more careful, but because the platforms stopped assuming they would.