For two years the enterprise AI agent conversation has been stuck on the same question: who is on the hook when the thing does something? Not which model is smartest — who signed for it. Google Cloud has now shipped an answer, and it looks less like a product launch than like an HR department.
Agent Identity is generally available in the Gemini Enterprise Agent Platform. Every agent you deploy gets its own credential — a unique SPIFFE identity and an X.509 certificate issued at deploy time — rather than borrowing a service account or, worse, a human employee’s token. Google is treating agents as a native IAM principal type, the same architectural tier as a user or a service account, with permissions bound directly to the runtime the agent executes in.
Alongside it, Agent Runtime now supports agents that run continuously for up to seven days, holding state across the whole window and backed by a persistent memory store. That is the other half of the pitch: an agent that can carry a multi-stage onboarding or a week-long outbound sequence without a human restarting it every session.
Why the identity piece matters more than the runtime
The seven-day number is the one that will get quoted. The certificate is the one that changes deployments.
Google’s stated design goals for Agent Identity read like a list of the exact failures that have been showing up in incident reports all year: least-privilege permissions instead of inherited blanket access; access bound to the runtime to blunt token theft; non-repudiable auditing of every agent action; and automatic lifecycle management so credentials don’t linger after an agent is retired. Managed runtimes route agent traffic through a gateway, which is where that logging actually happens.
Each of those maps to something that has already gone wrong somewhere. Over-permissioning is not hypothetical — research published earlier this month found that most agents provisioned beyond their default settings were handed allow-all access rather than task-scoped permissions. Dormant credentials are how quiet compromises stay quiet. And “which agent did this, acting for whom” is the question that turns a fifteen-minute investigation into a three-week one.
Our take: the story here is accountability, not capability. Agents have been able to do the work for a while; what they could not do was be held responsible for it in a form an auditor would accept. A per-agent certificate that binds an action to a specific runtime under a specific delegation is boring plumbing — and boring plumbing is exactly what a compliance team needs before it signs anything. Expect every serious agent platform to ship a version of this within two quarters, because the alternative, agents operating on borrowed human credentials, is now visibly the amateur option.
A seven-day agent is a different operational animal
A model call is a transaction. A seven-day agent is a process, and processes need monitoring, a kill switch, and someone whose pager goes off. Long-running state also shifts the failure mode: a one-shot agent that gets a task wrong produces one bad output, while an agent quietly wrong for four days has been compounding.
That is why the identity work and the runtime work landed together. You cannot responsibly let something run unattended for a week unless you can reconstruct afterwards exactly what it touched and under whose authority. Give an agent a week of autonomy without an audit trail and you have not automated a workflow — you have created an unlogged employee.
What to watch
- Whether rivals match the identity primitive, not the runtime length. Runtime duration is a config value. A native IAM type is a platform commitment.
- Whether auditors accept it. Non-repudiable agent logging is only worth something if assessors and internal audit treat an agent certificate as sufficient attribution. That verdict comes from them, not from Google.
- Whether least-privilege survives contact with users. Every permissions system ships secure and gets widened by the first team that hits a wall on a Friday afternoon. The default matters less than what the escape hatch looks like.
- Delegation chains. Agents authenticating on behalf of an end user are the hard case — that is where privilege quietly escalates when agent A calls agent B.
The agent era has been waiting on a badge system, and one just shipped. The open question is whether anyone else builds theirs before something expensive goes wrong.