> ## Documentation Index
> Fetch the complete documentation index at: https://silmaril.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Agent Gateway

> Configure model and tool boundaries for Google Cloud Agent Runtime and Agent Gateway.

Use Agent Gateway as the connection point for Agent Runtime model and tool traffic. Keep the routes your agents use together with their identity, network and content-check configuration.

## Before you start

Get your Firewall endpoint, credentials and Google Cloud connection configuration through [deployment access](https://silmaril.dev/docs/start/access.md). You will also need access to the project, runtime deployment and Gateway bindings for your agents.

| Setting | What to prepare |
| - | - |
| Workload | Agent Runtime deployment, framework, model APIs and tool connections. |
| Gateway | Project, region, bindings, ingress and egress routes. |
| Identity | Service accounts, IAM permissions and secret storage. |
| Network | Connectivity from the connection point to your Firewall endpoint. |
| Responses | Buffering, body-size limits and request timeouts. |

## Set up the connection

**1. Choose the protected routes**

Identify the model APIs, remote tools and services your agents call. Map them to the runtime's Gateway egress routes and retain the existing IAM and network controls.

**2. Apply your connection configuration**

Use the Google Cloud configuration supplied with your Silmaril deployment to connect the selected request and response boundaries to Firewall. Store credentials in your Google Cloud secret store and start in observation mode.

**3. Verify and enable enforcement**

Send a model request and a tool call. Check their findings, then test a blocked request and response before enabling enforcement on the selected routes.

## Model and tool boundaries

| Boundary | Check |
| - | - |
| Model request | User input before the provider runs. |
| Model response | Generated content before the application receives it. |
| Tool call | Tool name and arguments before execution. |
| Tool result | Returned content before the agent consumes it. |

Keep runtime bindings and model/tool routes aligned with your connection configuration. Application-owned calls can also use a [framework integration](https://silmaril.dev/docs/integrations/frameworks.md) or [SDK](https://silmaril.dev/docs/start/quickstart.md).

## Operate the connection

Use observation mode to review findings and latency. Enable enforcement once request and response checks behave as expected. Keep the previous Gateway bindings and policy revision for rollback, and verify both boundaries after a routing change.

See [Google's Agent Runtime routing guide](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/runtime/agent-gateway-runtime-deploy) for Gateway ingress, egress and runtime settings.

## Next steps

[Verify your integration](https://silmaril.dev/docs/start/verify.md), then review [findings](https://silmaril.dev/docs/operate/findings.md) and [modes and enforcement](https://silmaril.dev/docs/guides/enforcement.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.