Every enterprise wants AI agents doing real work. Far fewer security teams are ready to let them. The hesitation isn't about whether an agent can connect to a system. It's about what the agent does once it gets there.
Saviynt Zuma’s integration with Google Agent Gateway serves as the managed entry and exit point for agent traffic on Google Cloud, becoming the decision point for the gateway. Before an agent's tool call goes through the gateway, it asks Zuma whether it should be allowed.
The risk lives in the action
As AI agents move from pilot to production, the risk moves with them. An agent that summarizes documents is one thing. An agent that calls tools, queries APIs and updates records on its own is another.
Traditional access controls for human identities answer one question: should this identity reach this system? An agent passes that test easily. It's registered, holds valid credentials and has the tools it needs. But what it does next is driven by a prompt, and prompts can be careless, ambiguous or deliberately manipulated.
The problem compounds because agents don't stay in one place. A single workflow can start in Google Cloud and reach into another cloud, a SaaS application and an on-prem system. Controls tied to one platform leaves gaps everywhere else.
Without a trusted way to govern what agents do with their access, security teams slow or block adoption. Google itself has identified identity and governance as one of the biggest friction points for enterprise AI. In Google’s recently released State of AI infrastructure report, 79% of tech leaders cite security, governance, or operations as their most significant challenge and friction point to scaling runtime execution or inference.
Enterprises have spent years building identity and governance programs. They expect agentic AI to build on that foundation, not start a parallel one. Zuma’s integration means customers can keep and continue to utilize their existing identity investments.
This builds on what we announced in June, when Saviynt joined Google Agent Cloud as a launch partner and extended lifecycle governance to AI agents: discovery, posture, ownership and registration. That work answers whether an agent should exist and who is accountable for it. The expanded integration answers the next question: should this specific action happen, right now?
How it works: Google enforces, Saviynt decides
A loan-processing agent tries to pull a customer's credit report. The request reaches Agent Gateway, which stops and asks Zuma: "This agent wants to call the credit bureau's get_report tool for customer #4471; should I allow it?" Zuma checks its policies (is this agent allowed to read credit data?), the agent's intent (does pulling a credit report fit what this agent is supposed to do?), and its recent behavior (is this a normal request, or has this agent suddenly started pulling thousands of reports?). It answers allow or deny, and Agent Gateway enforces that answer forwarding the call to the credit bureau or blocking it on the spot.
Consider a CRM agent that suddenly requests a supply chain tool. The agent is authenticated and the tool is reachable, but nothing about the agent's purpose involves supply chain systems. Saviynt denies the call, and the supply chain system never sees the request. The agent's normal CRM work continues uninterrupted.
Because Saviynt's decision service is modular, customers don't need to replace the infrastructure they already run. Google provides the managed enforcement. Saviynt provides the access decision.
Three layers of defense at the moment of action
In our defense-in-depth series, we laid out five layers of security for AI agents. Layers 1 and 2, platform guardrails and governance, determine whether an agent should run at all. Layers 3 through 5 determine whether each individual action should happen. Go back to the loan-processing agent. Every time it reaches for a tool, Agent Gateway pauses and asks Zuma whether the call should happen. Zuma answers from three angles.
- Layer 3: Policy. Zuma blocks actions the agent is never allowed to take, like pulling a report for someone who hasn’t applied or calling a tool that changes a credit file, even if the underlying service account has broader access.
- Layer 4: Intent deviation. Zuma compares each action to the agent’s stated purpose. If a prompt-injected document tricks the agent into emailing customer #4471’s credit report to an outside address, Zuma recognizes that it falls outside the agent’s job and stops it, even though reading reports and sending email are both allowed.
- Layer 5: Anomaly and drift. Zuma learns the agent’s normal behavior and flags departures from it, like 600 report pulls overnight or a bulk export tool it has never used. Teams can monitor first, then enforce once the baseline is set.
Intent deviation detection and anomaly/drift detection surface risks that policy alone would miss. A risk that slips past one layer runs into the next.
One governance story, from catalog to call
Runtime decisions are only as good as the context behind them. That's why Saviynt pairs real-time enforcement with Zuma's governance layer: a catalog of agents and the tools they use, segregation of duties across agents and systems, and review of how humans delegate authority to agents. The ownership, purpose and scope set during governance inform every decision made at runtime.
Google provides the platform and the enforcement. Saviynt provides the identity intelligence and the decision. Together, they let security teams stop choosing between moving fast and staying in control.
Learn more about Zuma at saviynt.com/zuma or find Saviynt on Google Cloud Marketplace.
