Are we finally moving beyond the 'Agentic Hype' phase and into the era of operationalised, sovereign agent deployments?

The announcement of the FactSet partnership with Google Cloud underscores a pivotal shift in how we architect AI-native systems. We are moving away from stateless, prompt-response interactions towards long-term, stateful agents capable of managing complex business processes like deal advisory and corporate finance. This evolution requires moving beyond simple LLM implementations and embracing a holistic platform approach that prioritises governance, memory, and, most critically, identity. As we integrate these agents into our existing cloud infrastructure, we must treat them not as ephemeral scripts, but as first-class principals within our identity and access management (IAM) frameworks.

To build reliable agentic systems, we must adhere to three foundational architectural principles that treat security as an inherent property of the agent lifecycle rather than an afterthought.

✔️ Identity-Centric Agent Governance. Agents require a verifiable, unique cryptographic identity to interact securely with cloud resources. By leveraging new Agent Identity principals, distinct from human users and service accounts, we can enforce granular, least-privilege access using Identity-Aware Proxy (IAP). This ensures that even if an agent operates autonomously, its scope of action is strictly bounded by auditable IAM policies.

✔️ Unified Security Policy Enforcement. The integration of Google Cloud with Okta for AI Agents effectively bridges the gap between enterprise identity governance and agentic execution. By delegating real-time authentication to Okta through the Google Agent Gateway, we can enforce uniform security posture across browser-based work, mobile, and desktop environments, ensuring that agentic autonomy does not create unmonitored security gaps.

✔️ Serverless Agent Runtime Orchestration. With the new Agent Runtime capabilities, we must prioritise low-latency, high-scale execution by leveraging sub-second cold starts and long-running operations. Moving agents to a fully managed, serverless platform allows us to decouple our business logic from the underlying infrastructure, effectively treating the 'agent' as the unit of scale and management, rather than the container or VM.

Ensuring these systems remain secure requires a shift towards active observability and guardrails. As we scale, the focus must remain on implementing human-in-the-loop approvals for sensitive, irreversible actions, and leveraging new defensive tools like Agent Gateway to prevent data exfiltration and prompt injection. We are building the connective tissue between our data and the agents that act upon it; our success depends on the rigour of the identity and governance framework we place around those agents today.