A library program-recommendation agent began issuing an unusually high volume of tool calls overnight, and staff want a control that can automatically throttle or flag this kind of anomaly as it happens. Which Google Cloud capability is designed for that?

Agent Gateway sits in the path of agent-to-tool traffic, which is exactly where anomalous call volume can be observed and acted on in real time — rate-limiting a runaway agent or flagging the spike for review before it compounds. Skill Registry governs which skills an agent is permitted to use at all, a pre-runtime approval gate that has nothing to do with monitoring the volume of calls an already-approved skill generates. Agent Registry tracks which agent version is deployed and its history, useful for later investigation of what code was running during the spike, but it isn't positioned to observe or throttle live traffic. Sensitive Data Protection scans data content for sensitive patterns like identifiers, which addresses a data-classification problem, not a traffic-volume or rate problem — a spike of entirely benign tool calls would never trigger it. A scope caveat: traffic-level throttling catches volume anomalies but won't by itself explain why the volume spiked, so it should feed into a broader investigation rather than stand alone as root-cause analysis. As an operational check, an architect can review Agent Gateway's traffic logs for the overnight window and confirm whether the flagged calls originated from a single tool integration or were spread across many, which narrows down the cause.