Skip to main content
Use Agent Gateway as the connection point for Agent Runtime model and tool traffic. Keep the routes your agents use together with their identity, network and content-check configuration.

​
Before you start

Get your Firewall endpoint, credentials and Google Cloud connection configuration through deployment access. You will also need access to the project, runtime deployment and Gateway bindings for your agents.

​
Set up the connection

1

Choose the protected routes

Identify the model APIs, remote tools and services your agents call. Map them to the runtime’s Gateway egress routes and retain the existing IAM and network controls.
2

Apply your connection configuration

Use the Google Cloud configuration supplied with your Silmaril deployment to connect the selected request and response boundaries to Firewall. Store credentials in your Google Cloud secret store and start in observation mode.
3

Verify and enable enforcement

Send a model request and a tool call. Check their findings, then test a blocked request and response before enabling enforcement on the selected routes.

​
Model and tool boundaries

Keep runtime bindings and model/tool routes aligned with your connection configuration. Application-owned calls can also use a framework integration or SDK.

​
Operate the connection

Use observation mode to review findings and latency. Enable enforcement once request and response checks behave as expected. Keep the previous Gateway bindings and policy revision for rollback, and verify both boundaries after a routing change. See Google’s Agent Runtime routing guide for Gateway ingress, egress and runtime settings.

​
Next steps

Verify your integration, then review findings and modes and enforcement.