Platform Pulse: BigQuery Graph GA, Cloud Run Instances, and Agent Identity

🔐 Zero-Trust Security, Identity & Threat Defence

Enterprise security paradigms are rapidly formalising around autonomous agent identities, dynamic perimeter policy intelligence, and hardened runtime guardrails.

Human, Machine, Agent: The Three Identity Kinds on Google Cloud: The evolution of identity architecture on Google Cloud, establishing a dedicated third class of identity (Agent Identity) alongside traditional human users and machine service accounts to enable scoped, auditable delegation.
Empowering autonomous agents with advanced security governance: Key insights from Google Cloud's State of AI Infrastructure report on establishing the necessary guardrails, deterministic authorisation boundaries, and audit logging to safely operationalise autonomous agent execution.
How Blackline simplifies perimeter policy intelligence with VPC Service Controls: How Blackline prevents data exfiltration and simplifies complex perimeter architectures by leveraging VPC Service Controls policy intelligence tools, including Violation Analyzer and real-time violation dashboards.
Securing Centralized Egress: A Deep Dive into GCP Secure Web Proxy (SWP) & PSC with TLS Inspection: A comprehensive guide to architecting centralised outbound internet egress across multi-VPC enterprise topologies using Secure Web Proxy, Private Service Connect, and dynamic certificate minting for Layer 7 TLS inspection.
How to wear Model Armor 3: How you protect sensitive data from LLM. Do you need to?: Practical architectural guidance on evaluating when to scrub or redact sensitive payloads using Google Cloud Sensitive Data Protection (SDP) and Model Armor filters prior to model inference.
Securing your agent in Agent Platform with Agent Gateway and Model Armor: Hardening autonomous enterprise agents hosted on Gemini Enterprise Agent Platform by coupling Agent Gateway policy enforcement with Model Armor prompt sanitisation and jailbreak defence.
Cloud Storage: Bucket Access, Evidence, and the Public-Exposure Problem: Analysing common Cloud Storage IAM misconfigurations, forensic artefact recovery, and proactive organisation policies required to eliminate accidental public data exposure in GCP environments.
Financially Motivated Threat Actor BREEZE COMET Targets Brazil: Mandiant investigates the tactics, techniques, and tooling employed by financially motivated threat group BREEZE COMET against financial services, providing actionable detection and hardening recommendations.
Google Cloud Security Readiness Check: An open-source, client-side architectural assessment that evaluates Google Cloud environments against 29 hardened baseline security controls across seven foundational security domains.
Cloud CISO Perspectives: Tips on securing the water sector in the AI era: Actionable cybersecurity guidance from Google Cloud CISO perspectives for operational technology (OT) operators and utility providers to protect critical water infrastructure against sophisticated attacks.
Bringing Your Own Agents into SecOps SOAR Playbooks with Google ADK: Integrating custom autonomous agents built with Google's Agent Development Kit (ADK) directly into Chronicle SOAR playbooks to accelerate alert triage, RAG lookups, and multi-agent coordination via the Agent-to-Agent (A2A) protocol.
Getting started with Mantis, our open-source bug finding-and-fixing harness: An overview of Mantis, Google's open-source AI harness designed to automate vulnerability discovery, repository analysis, and security patch generation at machine speed.

📊 High-Performance Databases, Lakehouse & Big Data Analytics

Modern data platforms are embedding zero-shot foundation models directly into SQL engines, standardising open lakehouse catalogues, and operationalising graph semantics for agentic grounding.

BigQuery Graph is now GA: the knowledge foundation for the agentic era: Google Cloud announces the General Availability of BigQuery Graph, empowering data teams to query multi-hop relationships with standard Graph Query Language (GQL), analyse complex topologies, and ground AI agents directly on enterprise data without moving it.
Introducing TabFM in BigQuery: Predictive analytics reimagined: BigQuery unveils TabFM in Preview, Google's foundation model for tabular data that performs zero-shot regression and classification using in-context learning directly inside AI.PREDICT SQL statements without requiring model training.
From weeks to minutes: The new agentic era of data pipelines: Leveraging the Google Cloud Data Agent Kit to design, generate, and troubleshoot Apache Airflow DAGs and Cloud Composer pipelines in minutes using natural language.
Seven Iceberg REST Catalogs: What They Declare, and What They Serve: A rigorous technical audit comparing published specifications against live API responses across seven leading Apache Iceberg REST catalogue implementations, including Google Cloud, AWS, Databricks, Snowflake, and Microsoft.
Simplify pipelines with new BigQuery identity columns: BigQuery introduces native identity columns in Preview, enabling tables to automatically generate sequential 64-bit integer surrogate keys and streamlining data ingestion pipelines.
Using OKF with Knowledge Catalog to serve context for agents: Sharing and governing enterprise domain knowledge, database schemas, and analytical rules across an entire organisation by publishing Open Knowledge Format (OKF) bundles into Google Cloud Knowledge Catalog.
What Your Schema Cannot Tell Your Agent, Open Knowledge Format Can: Moving beyond fragile prompt strings and ambiguous column names by structuring enterprise business logic into Git-versioned Markdown OKF files to dramatically boost AI SQL generation accuracy.
BigQuery Slot Contention Is an Architecture Problem, Not a Query Problem: Diagnosing query queueing, fair-share slot starvation, and reservation concurrency bottlenecks by re-architecting project topologies and workload assignments rather than tweaking individual SQL queries.
Why that subquery in your WHERE clause might be scanning your whole table: Explaining how inline dynamic subqueries in BigQuery WHERE clauses can inadvertently disable partition pruning, resulting in unintended full-table scans and runaway compute costs.
A year of AI functions in BigQuery: the whole series in one place: A comprehensive reference guide and round-up of the multimodal, generative, and forecasting SQL functions integrated natively into BigQuery over the past twelve months.
Optimizing Cost and Performance in BigQuery with Window Functions: Demonstrating how replacing expensive self-joins with SQL window functions dramatically cuts bytes processed and execution time in complex e-commerce funnel analytics.
How Yahoo optimizes resources with flexible VMs in Managed Service for Apache Spark: How Yahoo reduced provisioning failures by 85% and optimised infrastructure utilisation by adopting flexible VM configurations in Google Cloud Managed Service for Apache Spark.
GA4 doesn’t send events in the order they happened. But the batch fields will tell you the truth!: Reconstructing the precise chronological order of client-side user sessions in BigQuery by leveraging the batch_page_id, batch_ordering_id, and batch_event_index fields from Google Analytics 4 exports.
Unifying Google Workspace and Apache Iceberg: Serverless Lakehouse Management: Integrating Google Workspace data assets directly with Apache Iceberg tables on Google Cloud to manage serverless lakehouse tables with minimal infrastructure overhead.

⚡ Cloud-Native Infrastructure, GKE & Serverless Workloads

Infrastructure engineering is pivoting to dedicated singleton container instances, kernel-isolated sandboxes for distributed compute, and fine-grained Gateway traffic controls.

Deploy personal AI agents with Cloud Run instances: Google Cloud launches Cloud Run instances in Preview, offering cost-effective, singleton compute runtimes designed specifically for hosting persistent, long-lived workloads and personal AI agents.
Bringing gVisor sandboxes to distributed Ray clusters: Pairing Ray's distributed runtime with gVisor kernel-level sandboxing on GKE to scale up to 100,000 secure, isolated worker tasks in 17.3 seconds across multi-tenant GPU and CPU nodes.
Safely Running Untrusted Code: A Hands-On Guide to Google Cloud Run Sandboxes: A practical guide to implementing zero-trust code execution planes on Cloud Run, isolating dynamic scripts and untrusted agent tools without the latency or complexity of traditional virtual machines.
Deploying GKE Inference Gateway Powered by llm-d: The Ultimate Guide to Model-Aware Routing on Kubernetes: Implementing model-aware routing, KV prefix cache hits, and predictable Time-to-First-Token (TTFT) at scale on GKE using GKE Gateway and the open-source llm-d inference proxy.
Never* Run Out of Compute: A Practical Guide to GKE Resource Obtainability: Mitigating capacity stockouts and ensuring robust workload obtainability on GKE through multi-zone fallbacks, Spot instance diversification, compute reservations, and custom ComputeClasses.
How Uber improves network reliability while unblocking cloud migration: How Uber and Google Cloud co-developed Application Awareness on Interconnect (AAI) to classify and prioritise critical network traffic, de-risking their hybrid cloud AI migration.
Simplify your resilience testing strategy with Google Cloud Fault Injection Testing: Introducing Google Cloud Fault Injection Testing (FIT) in Preview to automate chaos engineering and validate distributed system failover behaviour under simulated network and zone disruptions.
Native CORS support on GKE Gateway: Offloading cross-origin policy management to infrastructure: Declaratively enforcing Cross-Origin Resource Sharing (CORS) policies at the GKE Gateway level, offloading repetitive HTTP header management from containerised application microservices.
Running Code OSS on Cloud Run instances: What Works, What Breaks, and What I Learned: Testing the boundaries of Cloud Run instances by running a containerised Code OSS development environment, evaluating filesystem persistence, session affinity, and cold-start behaviour.
How to set up Multi-Cloud Interconnect between AWS and GCP using Terraform: A step-by-step Terraform configuration guide establishing direct, bidirectional private-IP cross-cloud interconnect between AWS and Google Cloud Platform.
Centralized Google API traffic Inspection with a Network Virtual Appliance (NVA): Designing a centralised egress architecture using Private Service Connect (PSC) and Network Virtual Appliances (NVAs) to inspect and log all Google API traffic across enterprise VPCs.
Deploy your App Engine apps to Cloud Run in a single command: Accelerating legacy App Engine modernisation to Cloud Run using automated CLI tooling to migrate runtime dependencies, bundled services, and deployment pipelines in one command.
OSS - Kubernetes on GCE, DRA Driver for NVIDIA GPUs, DRANET (OSS) and NCCL test - AI Infra: Deploying a high-performance open-source Kubernetes cluster on Compute Engine with NVIDIA Blackwell B200 GPUs, Dynamic Resource Allocation (DRA) drivers, and DRANET networking validated via NCCL benchmarks.

🛠️ AI Agents, Runtimes & Platform Modernisation

Teams are moving from raw prompt loops to asynchronous multi-agent coordination, structured context storage, and idiomatic SDK interfaces.

FinOps for the AI era: New flexible billing and cost controls for agents: Google Cloud introduces flexible billing, committed use options, and granular cost management controls designed specifically for agent workloads across Gemini Enterprise, Agent Platform, and Google Antigravity.
Multi-Agent Does Not Mean Parallel: Safe Workflows with Google ADK: Core architectural design principles for building reliable multi-agent systems using the TypeScript Agent Development Kit (ADK), establishing why parallel execution is suitable for read-only evidence gathering but detrimental to mutable state.
Your Google ADK Agent Has Four Places to Put Context. Choose Carefully.: Preventing prompt bloat and runaway token costs by categorising agent data into four distinct contexts within the Google ADK: session events, working state, long-term memory, and versioned artefacts.
4 engineering patterns behind the strongest AI Agents Challenge submissions: Architectural takeaways from the Google for Startups AI Agents Challenge, highlighting the adoption of bidirectional MCP servers, asynchronous event buses, strict schema validation, and tiered model routing.
Your Agent Doesn’t Know How to Wait: Benchmarking three waiting mechanisms for long-running cloud operations (in-loop polling, server-side blocking, and harness-managed tasks) and demonstrating how improper polling exponentially inflates model token bills.
Announcing the Google Gen AI SDK for Kotlin 1.0: Idiomatic multiplatform access to Gemini: Google releases the 1.0 General Availability version of the Google Gen AI SDK for Kotlin, bringing idiomatic coroutine support, type safety, and multiplatform compatibility across Android and JVM runtimes.
Spanner migrations: Automating dual-write with Antigravity CLI for minimal disruption: How an automated code refactoring pipeline powered by the Antigravity CLI streamlined application dual-writes and data verification during a high-scale Cloud Spanner migration.
Enterprise-Grade Precision for Long-Context Multimodal Embedding Inference on Cloud TPU: Implementing high-throughput multimodal embedding pipelines on Cloud TPU v5e/v6e with vLLM, hardware-safe tensor alignment, and a hybrid StepPool architecture on GKE.
How to Evaluate Live & Voice Agents in ADK: Transitioning conversational and voice agents from prototype to production using automated ADK live evaluations, pitting agent graphs against LLM-simulated users producing synthetic audio via Gemini TTS.
Tracking Antigravity developer costs with BigQuery: Designing a granular per-user token and cost attribution dashboard for Google Antigravity developer teams by querying Cloud Logging and BigQuery Billing Export data.
New AI-powered quick assessments in Migration Center turbocharge modernization: Migration Center launches AI-powered Quick Assessments to deliver instant infrastructure TCO modelling, automated service mapping, and prioritised modernisation planning.
Grok 4.6 available now on Gemini Enterprise Agent Platform: SpaceXAI's Grok 4.6 is now available in Public Preview as a fully managed serverless endpoint within Model Garden on Gemini Enterprise Agent Platform, supporting complex multi-step reasoning.
Not All LLM Workloads Are Equal: Benchmarking TPU Performance on Classification vs. Generation: Detailed benchmarks comparing compute-bound classification against memory-bound autoregressive token generation for Gemma 3 on Cloud TPU v6e, detailing throughput gains with vLLM bucket padding.
How We Built AutoPatch: An Autonomous CI/CD Remediation Agent Powered by Google Gemini & GCP: Building AutoPatch, an autonomous engineering agent that intercepts failed GitHub Actions workflow runs, identifies root causes, and creates validated, test-verified pull requests within 30 seconds.
Kubernetes Podcast Episode 272: Agent Substrate: Tim Hockin and Brandon Royal discuss Agent Substrate, examining the architectural primitives, sandbox boundaries, and container abstractions required to run autonomous AI agents natively on Kubernetes.

📋 Essential Release Notes

A curated summary of platform updates, general availability milestones, and security patches across Google Cloud services.

BigQuery: BigQuery Graph is Generally Available (GA) with GQL CALL syntax and acyclic path functions; TabFM foundation models enter Preview for zero-shot predictive analytics (AI.PREDICT, AI.EVALUATE); identity columns for auto-incrementing surrogate keys enter Preview; and Cloud Observability monitoring for data agents is in Preview.
Cloud Run: Cloud Run instances launch in Preview, providing singleton compute runtimes for long-lived background jobs and personal AI agents. System-managed Agent Identities and automated enrollment into the Agent Registry are also available in Preview, alongside Go 1.27 GA runtime support.
Google Kubernetes Engine (GKE): GCPAuthzPolicy and GCPAuthzExtension resources enter Preview for GKE Gateway to enforce zero-trust identity policies; STRONG_COOKIE_AFFINITY session stickiness reaches GA; Network Endpoint Group (NEG) pre-provisioning is in Preview; and C3 bare-metal machine types are GA.
Cloud Storage: Storage batch operations are available, allowing dynamic object selection across up to 1,000 buckets using Common Expression Language (CEL) filters on Storage Insights metadata, bulk storage class transitions, and ACL patching.
Cloud SQL: Workforce Identity Federation authentication is supported across Cloud SQL for PostgreSQL and MySQL; Cloud SQL for SQL Server adds write endpoint DNS support for automatic replica failover redirection; and pgAudit secret masking reaches GA.
Cloud Spanner: Spanner PostgreSQL-dialect databases introduce support for the TABLESAMPLE operator for random dataset sampling, pattern-matching operators ILIKE and NOT ILIKE, and the pg.ilike function family.
Cloud Composer: Managed Airflow remote Model Context Protocol (MCP) server and Orchestration Pipelines are Generally Available (GA), and the Managed Airflow Agent is now directly accessible in the Google Cloud Console.
Sensitive Data Protection: Sensitive Data Protection content policies reach General Availability (GA), providing automated ALLOW/BLOCK verdicts based on data sensitivity, integrated directly with Gemini Enterprise and Gemini Notebook Enterprise.
Google Cloud Armor: Cloud Armor managed rulesets enter Preview, delivering continuously updated, threat-signature-driven protections for backend services and APIs against web vulnerabilities and DDoS attacks.
Service Extensions & Agent Gateway: Agent Gateway adds General Availability support for Service Extensions, enabling custom external authorisation callouts and centralised security mediation for incoming agent traffic.
Policy Intelligence: The Policy Analyzer remote MCP server reaches General Availability (GA), allowing AI agents and IDE assistants to analyse and audit IAM policies and permission bindings programmatically.
Virtual Private Cloud (VPC): General Availability for attaching multiple virtual network interfaces (vNICs) to Compute Engine instances in the same VPC network, and GA for reserving static external IPv6 BYOIP addresses for forwarding rules.
Cloud Trace: Trace sinks are officially retired in favour of Cloud Observability Analytics and direct BigQuery linked dataset querying; remote MCP servers now automatically generate trace spans for tool invocations.
Dataplex: Knowledge Catalog support for extracting and importing technical, semantic (MetricFlow), data quality, and lineage metadata directly from dbt Core artifacts is available in Preview via the gcloud alpha dataplex dbt CLI.