Securing and governing agentic workflows

GCP-PAA · 30 questions

• A city permitting chatbot must call a third-party payments API to collect application fees, and the architecture team needs the agent to authenticate to that external tool without embedding long-lived credentials in the agent's code. What approach fits this requirement?
• A 311 resident-service agent should be able to read and write two specific BigQuery datasets holding service-request records, but not the finance department's datasets that happen to share the same project. What should the architecture team configure to enforce this scope?
• A transit authority runs several cooperating agents — dispatch, incident triage, rider notifications — and operations staff want a single place to observe traffic between them and identify which agent issued which tool call. Which component is built for this?
• Before a new docket-summarization agent can serve courthouse clerks in production, an architecture review board wants a required approval and versioning gate so that unreviewed agent builds cannot reach citizens. Which Google Cloud component provides this governance point?
• A public-facing water-utility chatbot has started receiving crafted messages that try to override its system instructions and extract internal prompt content, and the team wants a managed control to catch this pattern rather than relying solely on how the system instructions are worded. Which control fits this need?
• An emergency-management coordination agent on Google Cloud reads incident PDFs from a handful of Cloud Storage buckets, and the security team wants its access limited strictly to those buckets and the read permissions it actually needs. Which approach best satisfies this requirement?
• A school-district IT helpdesk agent can install new skills contributed by different departments, and the CIO wants every skill formally vetted and approved before the agent can use it at runtime. Which Google Cloud capability is built for this?
• A housing authority casework system must clearly distinguish, in every access decision, whether a request originated from a caseworker logging in directly or from an autonomous agent acting on its own schedule. Which Google Cloud capability provides this distinction?
• County IT operates a dozen agents that each call several external SaaS tools, and rotating and auditing OAuth 2.0 tokens individually per agent has become unmanageable for the security team. Which approach addresses this at the architecture level?
• A library program-recommendation agent began issuing an unusually high volume of tool calls overnight, and staff want a control that can automatically throttle or flag this kind of anomaly as it happens. Which Google Cloud capability is designed for that?
• A parks-and-recreation reservation agent runs in one Google Cloud project but must never be able to reach resources in the finance department's separate project, even if a bug in its logic attempts it. Which control enforces this as a hard boundary?
• A public-health case-reporting agent has been redeployed several times, and an auditor needs to reconstruct exactly which agent version handled a specific case report submitted six months ago. Where should the auditor look first?
• A courts clerk workflow agent occasionally drafts responses that echo sensitive case details from records it retrieved, and reviewers want those outgoing responses screened before they reach an external party. Which capability fits this need?
• A transit dispatch system coordinates agents over both A2A and MCP protocols, and the security architect wants one consistent place to enforce policy regardless of which protocol a given interaction uses. What should the architect rely on?
• A permitting-application agent is being extended to process applicant PII, and the governance board requires a documented sign-off step before any agent version handling PII can move to production. How should this be implemented?
• A permitting chatbot is authorized to auto-approve routine applications but must pause and route borderline or high-value permit denials to a staff reviewer before acting. What design achieves this?
• A 311 chatbot keeps receiving messages that try to convince it to ignore its guardrails and reveal internal configuration details, and the team wants a filtering layer specifically aimed at catching this kind of manipulation. What should they add?
• A records-request agent acting on behalf of a specific resident must only surface documents that resident is personally entitled to see, not everything the agent's own service account can technically reach. What design ensures this?
• A county government is deploying an agent across multiple Google Cloud regions and must ensure resident data the agent collects never leaves the jurisdiction's approved region. Where should this constraint be enforced?
• A public-health intake agent stores full conversation transcripts for quality review, and those transcripts must have direct patient identifiers removed before they are retained long-term. Which capability fits this requirement?
• A courts agent's audit logs must be kept long enough to satisfy a records-retention statute but not indefinitely, and the architecture team needs to set that retention deliberately. What should the team do?
• A water-utility operations agent can recommend a valve shutoff based on sensor readings, but the design must ensure it cannot execute that action on its own without an operator confirming it first. What should the architecture include?
• After an incident involving a transit agent's automated rider notifications, the compliance office needs a full trail of every tool call the agent made in the hours before the incident. Where should they reconstruct this from?
• A housing authority eviction-casework agent can draft correspondence freely but must be blocked from invoking the case-status-change tool unless a second, independent verification step has occurred. What kind of control does this require?
• A school-district IT helpdesk agent's tool invocations need to be traceable end-to-end so support staff can diagnose why a particular ticket was routed or escalated incorrectly. Which pairing should the architecture rely on?
• A county clerk records agent must act using the identity of the specific clerk who invoked it, not a single shared service account, so IAM audit trails reflect the actual requester. What design achieves this?
• A permitting agent uses a RAG pipeline that ingests applicant-uploaded PDFs, and one uploaded document contains hidden text instructing the agent to bypass its review checklist. Which capability is designed to catch this before it reaches the model?
• An emergency-management agent can draft public alert messages during a weather event, but the safety design requires a human communications officer to approve wording before any alert is sent. What does this require in the architecture?
• A library recommendation agent's older version is being retired after a security review found it used an overly broad tool permission set, and the team needs to formally deprecate it without breaking dependent workflows. What should they rely on?
• A housing authority casework agent needs Cloud SQL write access, but the design must limit that access to only the specific tables it manages, not the full database used by other city departments. Which approach satisfies this?