Set up Agent Gateway for Workspace MCP ingress

Supported editions for this feature: Gemini Enterprise.

You can configure a Google Cloud project to connect to Google Workspace MCP servers through a data connector and enable opt-in Agent Gateway with Workspace Policy Decision Point (PDP) to have Workspace governance on them.

Setting up the Agent Gateway with Workspace PDP allows AI agents (such as Gemini Enterprise agents) to access Workspace application data (like Google Drive) while enforcing access control policies configured directly in the Google Admin console.

Prerequisites

Before setting up the Agent Gateway, you need:

Step 1: Create or select a Google Cloud project

  1. In the Google Cloud Console, create a new Google Cloud project or select an existing project for this setup, and note your project ID (for example, my-project-id).

Step 2: Enable required Network & Security APIs

Enable the Network Services and Network Security APIs on your Google Cloud project using gcloud or the Cloud Console:

gcloud services enable networkservices.googleapis.com \
                       networksecurity.googleapis.com \
                       --project=PROJECT_ID

Replace PROJECT_ID with your Google Cloud project ID.

Step 3: Enable Agent Registry API and MCP

  1. In the Google Cloud Console, navigate to APIs & Services and then Library.
  2. Search for and enable the Agent Registry API (agentregistry.googleapis.com).
  3. Enable Google Drive MCP or other MCP servers needed for your workflow. For details, go to Register MCP servers.

Step 4: Create and import Agent Gateway and authorization resources

Configure the Agent Gateway, Authorization Extension (Workspace Policy Decision Point), and Authorization Policy resources. You can define these resources declaratively using YAML configuration files and import them using gcloud:

  1. Create the Agent Gateway configuration file (agent-gateway.yaml):

    name: AGENT_GATEWAY_NAME
protocols:
- MCP
googleManaged:
  governedAccessPath: AGENT_TO_ANYWHERE
registries:
  - //agentregistry.googleapis.com/projects/PROJECT_ID/locations/global

    Replace AGENT_GATEWAY_NAME with a name for your Agent Gateway resource (such as ge-agent-gateway) and PROJECT_ID with your Google Cloud project ID.

  2. Create the Authorization Extension configuration file pointing to the Workspace Policy Decision Point (ws-pdp-authz-extension.yaml):

    name: AUTHZ_EXT_NAME
service: workspacepolicyengine.pa.googleapis.com
failOpen: true
timeout: 5s

    Replace AUTHZ_EXT_NAME with a name for the authorization extension (such as ws-pdp-authz-ext).

  3. Create the Authorization Policy configuration file (ws-pdp-authz-policy.yaml) to associate the extension with your gateway:

    name: AUTHZ_POLICY_NAME
target:
  resources:
  - "projects/PROJECT_ID/locations/LOCATION/agentGateways/AGENT_GATEWAY_NAME"
policyProfile: CONTENT_AUTHZ
action: CUSTOM
customProvider:
  authzExtension:
    resources:
    - "projects/PROJECT_ID/locations/LOCATION/authzExtensions/AUTHZ_EXT_NAME"

    Replace the following:

    • AUTHZ_POLICY_NAME: A name for the authorization policy (such as ws-pdp-authz-policy).
    • PROJECT_ID: Your Google Cloud project ID.
    • LOCATION: The region for your deployment (for example, us-central1).
    • AGENT_GATEWAY_NAME: The name of the Agent Gateway from step 1.
    • AUTHZ_EXT_NAME: The name of the authorization extension from step 2.

  4. Import the YAML configuration files using gcloud:

    # Import the Agent Gateway
gcloud beta network-services agent-gateways import AGENT_GATEWAY_NAME \
  --source=agent-gateway.yaml \
  --location=LOCATION \
  --project=PROJECT_ID

# Import the Authorization Extension
gcloud beta service-extensions authz-extensions import AUTHZ_EXT_NAME \
  --source=ws-pdp-authz-extension.yaml \
  --location=LOCATION \
  --project=PROJECT_ID

# Import the Authorization Policy
gcloud beta network-security authz-policies import AUTHZ_POLICY_NAME \
  --source=ws-pdp-authz-policy.yaml \
  --location=LOCATION \
  --project=PROJECT_ID

Step 5: Verify Agent Gateway setup & get the resource name

  1. List the deployed Agent Gateways to verify successful import:

    gcloud beta network-services agent-gateways list --location=LOCATION --project=PROJECT_ID

  2. Describe the Agent Gateway resource:

    gcloud beta network-services agent-gateways describe AGENT_GATEWAY_NAME --location=LOCATION --project=PROJECT_ID

  3. Copy the full Agent Gateway resource name (formatted as projects/PROJECT_ID/locations/LOCATION/agentGateways/AGENT_GATEWAY_NAME, for example, projects/my-project/locations/us-central1/agentGateways/ge-agent-gateway).

Step 6: Connect to Google Identity Provider

  1. In the Gen App Builder Engines Console, navigate to Settings and then Authentication.
  2. Connect your engine to the Google Identity Provider.
  3. For additional documentation, go to Google Cloud Data Source Access Control.

Step 7: Configure Agent Gateway in Gemini Enterprise instance

  1. In your Gemini Enterprise (GE) Instance, navigate to Connected data stores.
  2. Under MCP servers, select Configure Agent Gateway.
  3. Enter the full Agent Gateway resource name obtained in Step 5 (for example, projects/PROJECT_ID/locations/us-central1/agentGateways/ge-agent-gateway).

Step 8: Configure Workspace Agent Access Controls in the Google Admin console

After you set up the Agent Gateway and Workspace Policy Decision Point, you can manage agent access policies directly from the Google Admin console:

  1. In the Google Admin console, go to Menu and then Security and then Agent access controls.
  2. On the Settings tab, configure the default access policy for all Gemini Enterprise agents. For details, go to Control access to Gemini Enterprise agents.
  3. On the Agent management tab, add specific agents to your management list to configure individual access permissions (Trusted or Blocked). For details, go to Manage Gemini Enterprise agents for Workspace users.