Agent Runtimes and Control Planes Go Managed

The parts of an agent platform that teams used to build themselves (sandboxes, tool registries, MCP gateways, durable sessions and scoped credentials) were announced or released as products, previews and open standards between Oct 19 and Oct 23. The designs agree on one split: the harness that plans, the sandbox that acts, and a control plane that decides which tools exist, who may call them and with which credentials.

Part of This Week in AI & Systems #2: Hardening the Agent Stack.

---

What’s new this week

• Google Agent Compute Engine (Oct 22). Announced at AGNTCon + MCPCon, it gives each agent a hardware-isolated microVM that holds no credentials. It already runs Gemini’s agents, and a customer preview is planned “in the coming months.” An open-source counterpart, Agent Substrate, runs on GKE.
• AWS Agent Registry (Oct 20). A managed catalogue of MCP servers, A2A agents and agent skills that an orchestrator searches at runtime. A companion case study shows Eon putting more than 100 developers and an SRE agent behind one MCP gateway on AgentCore.
• Antigravity Enterprise Gateway is GA (Oct 20). According to Google Cloud’s release notes, organisations can route model inference requests from the Antigravity app, the Antigravity CLI and Antigravity for IDEs through a central gateway to inspect and audit it and to enforce their own security and egress policies.
• Celigo MCP Management (Oct 20). SiliconANGLE reports a combined MCP gateway and registry for controlling which people and agents may use which tools.
• MCP Apps in Gemini Enterprise (Oct 19). A Google Cloud developer guide shows how to ship tools that come with an interactive UI, hosted on a private Cloud Run service.
• Durable harnesses and plan-scoped access (Oct 19, Oct 23). Vercel open-sourced durable-harness, which lets Pi, OpenCode, Claude Code and Codex sessions survive crashes and timeouts, and described how its production agent turns an approved plan into a scoped, short-lived token.
• Agent Skills joins the Agentic AI Foundation (Oct 22). Anthropic donated the standard to the Linux Foundation’s AAIF, alongside OpenAI’s Open Responses, Hugging Face’s OpenEnv and Alibaba’s OpenSandbox.

Why it matters. For a team building an agent platform, these are reference designs to compare against: what isolates agent-run code, where credentials live, how tools are registered, approved and discovered, who checks each tool call, and what happens when a long session dies halfway through a turn.

Key ideas

• Brain and hands are separate. Google’s deep dive describes both Gemini teams splitting each agent into a harness (“brain”) that calls the model and a sandbox (“hands”) that runs code, shell commands and a browser. Each microVM has its own kernel and persistent disk and is paused while the agent “thinks” between tool calls.
• Assume the sandbox is compromised. The design rule, in Google’s words: “Assume an attacker controls everything inside the sandbox, and make sure they find nothing there to use.” The microVM has no standard network interface and holds no tokens or keys. Agent Gateway swaps in long-lived credentials outside the sandbox, after checking the session’s mTLS identity and egress policy.
• Approve before anything is discoverable. AWS’s sample orchestrator has no built-in tool list. It searches the registry, builds a client for each result and tears it down after the turn. A record moves from DRAFT to PENDING_APPROVAL to APPROVED before agents can find it, and IAM can keep publishers and approvers separate. Search results never include credentials, which come through a separate, trusted path.
• One gateway decides every tool call. Eon’s gateway evaluates each tools/call against Cedar policies in enforce mode: humans in approved groups get read access, and write tools are permitted only to specific agent identities. Eon reports onboarding cut from about two days to two minutes. Celigo sells the same shape as a product; its chief product officer says every call traces back to a real person and access is approved one tool at a time. Google’s Antigravity Enterprise Gateway applies it to model traffic: developers authenticate with a gateway API key, and requests run under a central service account, billed pay-as-you-go rather than against seat quotas.
• Tools can bring their own UI. MCP Apps (SEP-1865) is an open MCP extension that pairs a tool with a live widget. In Gemini Enterprise the widget renders in a sandboxed iframe in the chat or a side panel, so adjustments run in the widget without another model turn. Authentication has two layers: Cloud Run IAM answers “which service may call?” and in-app OAuth answers “which user is calling?”, because IAM alone cannot tell end users apart. Imported tools arrive disabled until an admin enables them.
• Prove who is calling. MCP has no built-in authentication standard, an AWS and Keyfactor reference architecture notes (Oct 20). Its answer combines signed request envelopes, user-signed delegation, RFC 8693 tokens limited to one audience, and real-time revocation checks.
• Make every turn replayable. durable-harness records an intent before each model or tool call and the outcome after it. After a crash, completed calls are read from the log rather than re-run or re-billed. Tools marked replay: 'safe' run again, and any other interrupted tool is reported to the model as “possibly run.”
• Approve a plan, not every click. Vercel Agent investigates with read-only scopes, then proposes a plan listing its tasks and the scopes they need. Approval produces a token with the read-only baseline plus the approved scopes, limited by the user’s own permissions. If the model tries anything outside them, Vercel’s APIs reject the request.

Composite of designs from Google, AWS and Vercel; not any one source’s diagram. Tap to enlarge.

Analysis: the same shape (harness, credential-free sandbox, and a control plane of registry, approval and identity-aware gateway) now appears across Google, AWS, Vercel and smaller vendors such as Celigo, which makes it a reasonable default for in-house platforms. Open question: whether Google’s scale figures, such as Agent Substrate’s 200,000-agent benchmark, hold for customer workloads once the Agent Compute Engine preview opens; today’s figures are Google’s own benchmarks.

Reading list

Grouped loosely: runtime and isolation (Google), registries and gateways (AWS, Google Cloud release notes, SiliconANGLE), tool UIs (Google Cloud), identity, sessions and permissions (AWS, Vercel), and standards (AAIF).

• Introducing Agent Compute Engine and expanded agent governance — Google Cloud, Oct 22, 2026. The announcement: microVM per agent, Agent Substrate for GKE (Google cites a 200,000-agent benchmark), and the Agent Gateway roadmap for token budgets and model routing.
• Inside Agent Compute Engine — Google Cloud, Oct 22, 2026. The engineering deep dive: why plain VMs and containers did not fit, the zero-secrets design, vsock-only networking and the malicious-email walkthrough.
• Discover tools at runtime with AWS Agent Registry — AWS Machine Learning Blog, Oct 20, 2026. A Discover → Instantiate → Execute loop with sample code, the approval lifecycle, and when build-time wiring is still the simpler choice.
• How Eon built multi-cloud investigation with an MCP Gateway on Amazon Bedrock AgentCore — AWS Machine Learning Blog, Oct 20, 2026. One gateway URL for developers and an SRE agent across AWS, GCP and Azure, Cedar policy examples, and lessons on policy size and tool filtering at scale.
• Google Cloud release notes: Antigravity Enterprise Gateway support — Google Cloud, Oct 20, 2026. The GA note: what the gateway routes, how developers authenticate, and how billing differs from seat-based quotas.
• Celigo launches MCP tool management for enterprise AI assistants and agent access — SiliconANGLE, Oct 20, 2026. A short launch report on a combined MCP gateway and registry, with quotes from Celigo and a customer. No technical detail beyond the vendor’s description.
• Developer’s guide to implementing MCP Apps in Gemini — Google Cloud, Oct 19, 2026. The three-tier architecture, the two authentication layers, and step-by-step registration of a Cloud Run MCP server as a Gemini Enterprise data store.
• Securing AI agent identity with X.509 PKI on AWS — AWS Machine Learning Blog, Oct 20, 2026. Four mechanisms for agent-to-agent and MCP calls, with full source code.
• Making every harness durable — Vercel, Oct 19, 2026. The intent/outcome log, replay rules for tools, and self-hosting on Postgres. MarkTechPost’s summary (Oct 21) notes that the package is an experimental 0.0.x release with no published benchmarks.
• How Vercel Agent accesses production safely — Vercel, Oct 23, 2026. Intent, work, access and enforcement as four linked layers, and why plans and tokens must share one scope registry.
• Agentic AI Foundation announces four new projects — AAIF, Oct 22, 2026. Agent Skills, Open Responses, OpenEnv and OpenSandbox join MCP, A2A and AGENTS.md under neutral governance; Anthropic’s post (Oct 22) adds the proposed roadmap.

Background and prior art

• Firecracker: Lightweight Virtualization for Serverless Applications — Agache et al., NSDI 2020. The microVM design that made VM isolation cheap enough for per-request use, and the lineage behind per-agent sandboxes.
• Crossing the Threshold — Latent Space, Oct 14, 2026 (background, outside this issue’s window). Talks from AI Engineer New York on controls for financial agents; Bloomberg’s Andrey Rybka summed up the gateway idea: “Check every call, log it, and keep a kill switch.”
• Earlier in this series: The Agent Control Plane (Oct 17) on gateways, registries and approval controllers. This week’s launches turn several of those layers into managed services.

Enjoyed this? Follow me on X or connect on LinkedIn.