Quick answer
Google’s launch presents a layered pattern:
agent runtime
-> Agent Gateway for governed egress
-> API Gateway for model-tag routing
-> configured Vertex AI MaaS model
Keep the layers separate. Agent Gateway governs connectivity among users, agents, tools, models, APIs, and other agents. API Gateway model routing accepts an OpenAI-compatible model request and selects one configured same-host Vertex AI backend.
Responsibility map
| Layer | Owns | Does not prove |
|---|---|---|
| Agent Runtime | Agent code, state, orchestration | Permission to call every destination |
| Agent Gateway | Ingress or egress connectivity, authorization policy, eligible governance integrations | Model quality or route selection |
| API Gateway | OpenAPI endpoint, model router, transcoding, rate and token surface | Complete agent policy or cross-host routing |
| Vertex AI model | Target inference behavior and quota | Agent action authority |
Google’s Agent Platform documentation says an Agent Runtime and its Agent Gateway must share the same project and region. Model routing separately requires one Vertex hostname per router. Resolve both topology constraints before deployment.
Deployment gates
- Inventory agent identities, destinations, model targets, tools, data classes, regions, and projects.
- Define Agent Gateway ingress or egress mode and explicit authorization policies.
- Configure API Gateway routers only for approved model destinations.
- Validate certificates, workload identity, trust stores, authentication, and failure paths.
- Log the agent, user, gateway policy decision, requested model, resolved backend, tool call, and final action.
- Test policy denial, model quota, gateway outage, stale certificate, route mismatch, and cancellation.
- Keep an independent human approval and rollback path for material actions.
An agent’s access to a model does not authorize the model to use a tool, and a selected model does not prove that the final action is safe.
Use the rate and token guide for operating telemetry and the API Gateway vs. Apigee guide when broader enterprise API governance is required.
Frequently asked questions
How do Agent Gateway and API Gateway model routing work together?
Google’s launch describes routing agent egress through Agent Gateway for security governance, then passing eligible model traffic to API Gateway for dynamic routing among configured Google-hosted LLMs.
Does API Gateway replace Agent Gateway governance?
No. API Gateway model routing selects configured model backends. Agent Gateway owns separate governed connectivity and policy concerns for agent interactions.
Must Agent Runtime and Agent Gateway share a location?
Google’s current Agent Platform setup requires the agent and Agent Gateway to be created in the same project and region. Verify the live documentation for the exact deployment.
Official sources
- Google model routing launch and Agent Platform pattern
- Route Agent Runtime traffic through Agent Gateway
- Semantic governance policies overview
Source check: August 5, 2026. Verify Preview status, projects, regions, identities, certificates, policies, model endpoints, quotas, and terms.