As AI agents move from experimental prototypes to production systems, the risk of uncontrolled model behavior becomes a primary architectural concern. Unrestricted agents can inadvertently exfiltrate data or execute unauthorized actions if their tool-calling capabilities are not properly constrained.
The Agent Development Kit (ADK) provides a framework for building multi-agent systems, but security requires moving beyond default configurations. Architects must implement explicit boundaries to ensure that agents operate within defined safety parameters.
In short
- •
Implement granular identity management by assigning distinct service accounts to specific agent tools rather than granting broad permissions to the entire agent.
- •
Use tool-level access policies to enforce read-only constraints on sensitive resources, preventing model-driven actions from exceeding intended scope.
- •
Sandboxing model-generated code is a mandatory architectural step to mitigate risks associated with arbitrary execution in production environments.
- •
Perform a domain-specific risk assessment before deployment to map agent capabilities against potential failure modes and data exposure points.
Identity-Based Access Control
The most effective way to limit an agent's impact is to treat each tool as an independent identity. In ADK, you should avoid using a single, high-privilege service account for all agent operations. Instead, configure individual tools with the minimum necessary IAM permissions.
For example, if an agent requires access to a database, configure the specific tool responsible for queries with read-only access. Even if the underlying LLM is prompted to perform a destructive action, the external system's access policy will reject the request. This decoupling of model intent from system capability is the foundation of a secure agent architecture.
Sandboxing and Execution Boundaries
When agents generate and execute code, they introduce a significant attack surface. ADK architectures must include a sandboxed environment to isolate this execution from the host system. This prevents model-generated code from accessing local files, environment variables, or network resources that are not explicitly required.
Do not rely on the model's reasoning to enforce safety. Instead, treat all model-generated output as untrusted input. By routing code execution through a hardened sandbox, you ensure that even if an agent is compromised or hallucinates a harmful command, the blast radius remains contained within the isolated runtime.
Security in agentic systems is not a one-time configuration but a continuous design requirement. By enforcing strict identity boundaries and sandboxing execution, you build agents that are both capable and predictable.
Sources
ADK Security Documentation
https://adk.dev/safety
Google Developers Blog: ADK Overview
https://developers.googleblog.com/en/agent-development-kit-easy-to-build-multi-agent-applications
Google ADK Tutorial: Build AI Agents with Gemini (Code Examples)
https://aimakers.co/blog/gemini-adk-agents
