An LLM Judge and a Ledger: SwarmSentinel and SwarmSheriff next to Google's Agent Gateway
In my previous post I looked at AWS AgentCore Gateway, which checks each tool call against a Cedar policy, and argued that it needs something beside it that remembers the session. Google announced its own Agent Gateway at Gemini at Work 2026. I expected the same kind of per-request firewall, but the docs surprised me: Google's gateway does look at history, by handing it to a language model. Below…
Google's Agent Gateway acts as the network entry and exit point for agent traffic, handling user-to-agent, agent-to-tool, and agent-to-agent communication. The gateway checks HTTP traffic, including MCP and A2A, and enforces mTLS, DPoP, and IAM policies. It also scans prompts and tool responses for prompt injection and sensitive data using content filters.
Semantic Governance Policies allow administrators to write natural-language constraints, which are checked by a policy engine using an LLM. This engine verifies whether the call matches the user's intent and complies with the constraints. The gateway uses Service Extensions to enforce different policy types and allows delegating decisions to custom engines.
SwarmSentinel's ASP (Agent Security Policy) handles the invoice relay by tainting tainted contexts and dropping the transfer without reading the text. This approach differs from Semantic Governance, which relies on the LLM's reading of text to make decisions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
