Add a Gemini Enterprise Agent Platform connection

task australia Updated Sep 10, 2026 6 min read aict-configure-gcp-vertex-ai-security-connection.md
Raw file servicenow.com

Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform.

Before you begin

Confirm the following:

  • A Google Cloud project with the Vertex AI API in Google Cloud enabled and IAM permissions to create a service account.
  • A Google Cloud service account granted three IAM roles.
Role Scope Purpose
roles/iam.denyAdmin Organization Create and delete the Deny policy used to contain an agent.
roles/aiplatform.viewer Project level Read the agent's identity from Gemini Enterprise Agent Platform.
roles/resourcemanager.projectViewer Project level Resolve the Google Cloud project ID.

Deny policies are the only mechanism that overrides IAM allow policies, which makes them the reliable choice for containing an AI agent with the roles/iam.denyAdmin role. Removing an agent's role bindings isn't sufficient, because access granted elsewhere in the project still applies.

Gemini Enterprise Agent Platform doesn't provide an API to disable an agent without deleting it. Creating a deny policy requires the iam.denypolicies.create, update, and delete permissions. Google Cloud doesn't provide a way to obtain these permissions below the organization level. The roles/iam.denyAdmin role can't be granted on a folder or project, and the permissions can't be placed in a custom role at any scope. Grant the role at the narrowest scope the platform supports. For more information, see the Google Cloud IAM documentation.

The roles/iam.denyAdmin role carries residual risk. This role permits creating deny policies against any resource in the organization, which is broader than the scope required for AI agent containment. Google Cloud doesn't provide a way to narrow the grant by scope, so manage this risk through monitoring rather than IAM. Monitor Cloud audit logs for changes to who holds the role, and monitor all deny policy create and delete actions. Alert on any policy that isn't a project-scoped policy targeting a single agent identity.

Complete these additional prerequisites before continuing:

  • Download a JSON key for the service account. In the Google Cloud console, go to IAM & Admin > Service accounts, select the service account, then select Add key > Create new key and choose JSON as the key type. You'll need the private_key, private_key_id, client_email, and token_uri values from this file in the steps below.

  • For each ADK-based AI agent you want containment to cover, enable Agent Identity. Create an .agent_engine_config.json file with { "identity_type": "AGENT_IDENTITY" } and follow Create and deploy an agent with Agent CLI and Agent Identity to deploy the agent with a unique identity.

    Important: AI agent containment is supported only for Gemini Enterprise Agent Platform agents that have a unique agent identity configured this way.

Role required: creating the OAuth, JWT, and certificate records in steps 1–8 below typically requires an instance admin or integration admin role. Creating the security connector in steps 9–11 requires sn_ai_governance.ai_steward.

About this task

Gemini Enterprise Agent Platform authenticates using OAuth 2.0 with a JWT Bearer grant, which requires more setup than an access-key based connection: you convert the service account key into a Java Key Store, build a chain of OAuth and JWT records from it, and then attach the resulting Connection & Credential Alias to the security connector.

Procedure

  1. Create the X.509 certificate.

    Convert the service account's private key into a Java Key Store (.jks) file and import it as an X.509 Certificate. See the ServiceNow documentation on converting a private key to a Java Key Store. If your team already has a pre-generated .jks bundle, you can upload it directly instead.

    Field Description
    Name Descriptive name, such as the service account's email address.
    Type Select Java Key Store.
    Key store password Password used when the .jks file was created.
    Active Select this option.

  2. Create the JWT Keys record.

    Navigate to JWT Keys and create a new record.

    Field Description
    Name Descriptive name.
    Signing Keystore The certificate record from the previous step.
    Key Id The private_key_id value from the service account JSON key. Copy it directly.
    Signing Algorithm Select RSA 256.
    Signing Key The password used to create the certificate in the previous step.
    Active Select this option.

  3. Create the JWT Provider record.

    Navigate to JWT Provider and create a new record with the following:

    • Name: descriptive name.

    • Signing Configuration: the JWT Keys record from the previous step.

    • Expiry Interval (sec): 3600. Add these Standard Claims:

    • aud: The token_uri value from the service account key (typically https://oauth2.googleapis.com/token).

    • iss: The client_email value from the service account token.

    • sub: The client_email value from the service account token. Add this Custom Claim:

    scope : https://www.googleapis.com/auth/cloud-platform

  4. Create the Application Registry record.

    Navigate to Application Registries and create a new OAuth Provider record.

    Field Description
    Name Descriptive name.
    Provider Type Select Connect to a third-party OAuth Provider – Outbound (or the equivalent option on your instance).
    Default Grant Type Select JWT Bearer.
    Client ID The client_id value from the service account JSON key you generated earlier.
    Client Secret The private_key value from the service account JSON key, with \n sequences converted to actual newlines.
    Authorization URL https://accounts.google.com/o/oauth2/auth
    Token URL https://oauth2.googleapis.com/token
    Refresh Token Lifespan 8640000
    Active Select this option.

    Under OAuth Entity Scopes, add a scope named Vertex AI Scope with the value https://www.googleapis.com/auth/cloud-platform.

  5. Update the default OAuth Entity Profile.

    Open the default profile that was automatically created for the OAuth Provider in the previous step, and set:

    • Grant type: JWT Bearer.
    • JWT Provider: the JWT Provider record from the earlier step.
    • Is default: select this option. Add Vertex AI Scope under OAuth Entity Profile Scopes.

  6. Create the OAuth 2.0 Credentials record.

    Navigate to OAuth 2.0 Credentials and create a new record with the following:

    • Name: descriptive name.
    • OAuth Entity Profile: the profile from the previous step.
    • Applies to: All MID servers (or as appropriate for your instance).
    • Active: select this option. Use the Get OAuth Token related link to confirm the credential retrieves a token successfully.

  7. Create the Connection & Credential Alias.

    Navigate to Connection & Credential Aliases and create a new record with the following:

    • Name: descriptive name.
    • ID: a unique identifier for the alias.
    • Type: Connection and Credential.
    • Connection type: HTTP.
    • Default Retry Policy: Default HTTP Retry Policy.

  8. Create the HTTP(S) connection.

    From the Connections related list on the alias you just created, select New and fill in:

    • Name: descriptive name.
    • Credential: the OAuth 2.0 Credentials record from the earlier step.
    • Connection alias: the alias from the previous step.
    • Protocol: https.
    • Host: iam.googleapis.com.
    • Connection URL: https://iam.googleapis.com
    • Active: select this option.

  9. Navigate to AI Control Tower > Settings > Integrations > Control Enforcement Points.

  10. On the Available connectors sub-tab, select Gemini Enterprise Agent Platform.

  11. Fill in the fields and select Submit.

    Field Description
    Name Unique, descriptive name for this connection.
    Connection Alias The Connection & Credential Alias you created in the previous steps.
    Active Select this option.

Result

The connector appears on the Established connections sub-tab. AI Control Tower can now use this connection to enforce policies and apply AI agent containment using kill switch protocol to Gemini Enterprise Agent Platform agents that have a unique agent identity configured.

To verify the setup:

  • Confirm the HTTP connection appears in the Connections related list on the Connection & Credential Alias.
  • Confirm the OAuth 2.0 Credentials record can retrieve a token using Get OAuth Token.
  • Confirm the connector appears under Established connections on the Control Enforcement Points tab.

To deploy the AI agent, see Create and deploy an agent with Agent CLI and Agent Identity in Google documentation.

Parent Topic:Configuring security connections

Keywords ServiceNow OttoAI Agentsgenerative AIagentic AI
Search documentation
Search document titles and file paths on the australia branch