A parks-and-recreation reservation agent runs in one Google Cloud project but must never be able to reach resources in the finance department's separate project, even if a bug in its logic attempts it. Which control enforces this as a hard boundary?
Select an answer to reveal the explanation.
Short Explanation
Telling an agent "don't go into the finance project" in its instructions is like posting a sign on a door instead of locking it — a determined bug just walks past the sign. A PAB policy is the lock: it enforces the boundary at the identity layer, outside whatever the agent's own reasoning decides to try. That's the difference between a rule the agent is asked to follow and a rule it physically cannot break.
Full Explanation
A principal access boundary policy attached through Agent Identity enforces a hard limit on what a principal can reach, independent of the agent's own prompt, instructions, or reasoning path — so even a bug or a successful prompt injection that convinces the model to try cross-project access still hits a wall the access-control layer enforces. That structural independence from the model's behavior is exactly what "even if a bug attempts it" requires. System instructions are a request made to the model, not an enforced boundary; a sufficiently confused or manipulated agent can act against its own instructions since nothing outside the model stops it. Rate limits from Agent Gateway shape the pace and volume of requests but don't determine whether a request is permitted to cross a project boundary at all — a single well-timed request could still succeed. A code review confirming today's tool integrations are properly scoped is a point-in-time check; it says nothing about what happens after the next code change or a runtime decision the review never anticipated. A scope caveat: PAB policies constrain what a principal can reach, so they still depend on the agent's service account being correctly scoped in the first place. As an operational check, an architect can attempt a controlled test call from the agent's identity toward the finance project and confirm it is denied at the policy layer rather than merely logged.