Geminiby Google

Govern · Gemini

Gemini, governed in the browser, at the gateway, on the device.

Q: Does Agen replace Workspace and Gemini Enterprise admin controls?

No. Keep them. They govern who has the product and where data lives. Agen stops the leak at the paste, decides agent actions at the gateway, enforces on the device, and records all three.

Q: Can Agen govern Gemini's grounding on Gmail and Drive?

Grounding happens inside Google's cloud, so no browser or gateway sits in that path. Agen surfaces which accounts and agents are in use. Per-action verdicts apply at the paste, to agents that reach your systems through the gateway, and to Gemini CLI on the device.

Q: How are agents built in Gemini Enterprise governed?

Each one is discovered, assigned a named owner, and decided per action at the gateway for every connector it uses to reach your systems. Writes can require the owner's approval.

Q: Is Gemini CLI covered?

Yes. It runs on developer machines and is governed on the device by AgenShield, with the same policy as Claude Code, Codex and Cursor.

Q: Is BrowserShield generally available?

Early access. It is running with closed-beta design partners today. Ask about joining the program.

Gemini is grounded in Gmail and Drive for every Workspace user, Gemini Enterprise adds agents that act on Salesforce, Jira and ServiceNow, and Gemini CLI runs on developer laptops. BrowserShield stops company data at the paste. The gateway decides every agent action that reaches your systems. AgenShield governs the CLI on the device.

Book a demo See the verdicts

Enforced on the browserBrowserShieldearly accessCompany data stopped at the paste. Employees keep their tools. Only the leak stops.

sensitive pastes through, at the paste

surfaces governed: browser, gateway, device

<30ms

per-action verdict at the gateway

1:1

a named owner behind every Enterprise agent

How Agen governs Gemini

BrowserShield recognises API keys, credentials and sensitive data as they are pasted or uploaded into Gemini and blocks the paste. The rest of the session continues, and the person sees why.
Every Gemini surface in use, Workspace, Gemini Enterprise, Gems, personal accounts and Gemini CLI installs, becomes visible in the Agen.co console with the person behind each one.
Gemini Enterprise agents and connectors that reach your systems go through the gateway, where every action is decided in-line against the agent's identity and named owner, in under 30ms.
Gemini CLI on developer machines is governed on the device by AgenShield: file reads, shell commands and MCP calls judged before they execute.
Workspace admin controls, data regions and Gemini Enterprise access settings stay as configured. Agen adds the verdict at the paste, at the gateway and on the device, and the record of all three.

What Gemini reaches

An assistant that is already inside every document.

Gemini does not need a connector to reach Workspace data. It is grounded in it by default. Enterprise adds the rest of the company, and the CLI adds the laptop.

Workspace grounding: Gmail, Drive, Docs, Sheets, Calendar and Chat, read inside Google's cloud with the user's own permissions.
Gemini Enterprise connectors: Salesforce, Jira, ServiceNow, Confluence, SharePoint, Box and custom sources, searched and acted on across the company.
Agents and Gems: No-code agents and custom Gems built by business teams, running on connected data with actions attached.
Gemini CLI: A terminal coding agent on developer machines with file, shell and MCP reach, on the developer's own credentials.
Deep research and Canvas: Long multi-source research and in-place document and code editing.
Uploads and pastes: Anything a person pastes or uploads becomes model context: contracts, customer records, source code, keys.

Where the native controls stop

Admin settings govern who has Gemini. Not the paste, the action, or the laptop.

Workspace and Gemini Enterprise controls are the right controls to keep. They govern access to the product, not what a person pastes, what an agent does to your systems, or what the CLI does on a device.

The paste is the leak

Company data pasted into any AI tool leaves no trace in any log. Workspace policy sees that Gemini is on for an account, not what went into it.

visibility at the pastenone

Business-built agents have no owner on record

An agent built in Gemini Enterprise by a team runs on connected data with actions attached. Nothing says who is accountable when it writes to a system.

accountable owner per agentnone

Gemini CLI acts as your developer

It runs on standing credentials that already reach your repos and cloud projects. Nothing on the machine says whether the person or the agent chose the action.

author fielda person's name

Audit logs record usage, not verdicts

You can see that Gemini was used. You cannot show an auditor which pastes were stopped, which agent actions were judged, against which policy, and what was decided.

per-action verdict lognone

How Agen governs it

Stop the leak in the browser. Decide the action at the gateway. Enforce on the device.

The gateway decides. Shield enforces where the gateway cannot see. For Gemini that is BrowserShield at the paste, the gateway on Enterprise agents, and AgenShield on Gemini CLI.

01 · Discover

See every Gemini surface in use

BrowserShield surfaces Workspace and personal accounts. The gateway surfaces Enterprise agents and connectors. AgenShield surfaces Gemini CLI installs and their MCP servers.

02 · Identify

Tie each action to a person

Pastes and CLI sessions resolve to the person from your IdP. Every Enterprise agent becomes a governed principal with a named owner.

03 · Govern

Block, judge, enforce

Keys and sensitive data are stopped at the paste. Agent actions reaching your systems are decided at the gateway. CLI actions are judged on the device before they execute. All in under 30ms.

04 · Evidence

Record the chain

Every stopped paste, gateway verdict and device verdict logged with person, target and decision. Exported to your SIEM. Produced at action time.

Shield

The gateway decides. Shield enforces where the gateway cannot see.

For Gemini in the browser the leak is the paste, so BrowserShield does the work. Gemini CLI runs in the terminal, so AgenShield governs it on the device like any other coding agent.

On the device

AgenShield

Out-of-policy actions like touching production secrets or mass-deleting files are stopped before they execute. Everything else flows. Ships through your MDM.

AgenShield · Gemini CLI · dev-mbp-042blocked

Actionread · ~/.config/gcloud/credentials

Stoppedon device, before execution

Verdict25ms · logged

AgenShield in depth →

In the browser

BrowserShield early access

Primary for Gemini

Keys and sensitive data are recognised as they are pasted into AI tools, and the paste is blocked. Employees keep their tools. Only the leak stops.

BrowserShield · gemini.google.compaste blocked

Detectedcustomer records in paste

Everything elseflows normally

Verdictlogged · same audit chain

Join the early-access program →

Same policy · same identity · same verdictShield overview How the gateway decides

Governed actions

What Gemini asks to do, and what policy says.

Illustrative verdicts under a typical policy. Paste rows are BrowserShield. Agent rows are the gateway. CLI rows are AgenShield.

Typical per-action verdicts for Gemini
Gemini action	Verdict	Why
Ask a question with no company data in the prompt	allow	Nothing sensitive in the paste. The tool in use is recorded, the person keeps working.
Paste an API key or access token into a prompt	deny	Recognised at the paste and blocked before it leaves the tab. The person sees why.
Use a personal Gemini account with company data	deny	Outside the governed Workspace. Blocked at the paste, the person is pointed to the company account.
Enterprise agent reads Salesforce records through the gateway	mask	The read runs. Personal data is masked at the gateway before it enters the model context.
Enterprise agent creates a ServiceNow change request	human-in-the-loop	A write on a live system. The agent's owner approves before it lands.
Enterprise agent calls an internal API outside its grant	deny	Outside scope. Blocked at the gateway and logged against the agent and owner.
Gemini CLI edits files inside the working tree	allow	In scope for the developer and the task. Logged, not interrupted.
Gemini CLI reads cloud credentials on a developer laptop	deny	A credential has no place in an agent's context. Stopped on the device, before execution.

Verdicts are illustrative defaults. Every row is a policy you write once and Agen enforces per action, per identity.

Book a demo

See Gemini governed, live.

Thirty minutes on the way your teams already use Gemini. We show the verdict on each action, the named human behind the session, and the record it leaves. Bring your hardest question.

length30 minutes

formatlive, on your Gemini setup

you seeevery action decided at runtime

Watch it happen

Customer records head for Gemini. They never leave the tab.

An analyst pastes a spreadsheet block into Gemini to ask a question. BrowserShield recognises customer records in the paste and blocks it. The rest of the session continues.

blocked at the paste · live product scene

From connect to governing

Gemini does not change. Neither does your Workspace.

Your admin settings, data regions and connectors stay exactly as they are.

Day 1

Connect the gateway and your IdP

Enterprise agents and connectors that reach your systems route through the gateway. Every action resolves to a person through Google, Okta, Entra or any OIDC provider.

Day 1

Ship AgenShield, join BrowserShield early access

AgenShield deploys to developer machines through your MDM and governs Gemini CLI from day one. BrowserShield is running with design partners now.

Week 1

Run observe-only

See which surfaces, agents, connectors and CLI installs are actually in use across the company before enforcing anything.

Week 2

Turn on the policies that matter

Start with secrets at the paste, agent writes and CLI credential reads. People only notice the crossing action.

The platform

Discover, Govern, Shield. One policy plane.

The same three capabilities govern Gemini and every other agent you run, internal and external.

Expand a capability

Continuous discovery across your IdP, gateway, devices, cloud, and registries. Nothing has to self-register: agents are found, risk-scored, and resolved to a named human before they act.

Agentless and API-based across five surfaces
First-party, custom, and third-party agents alike
Every agent mapped to an owner, approver, and escalation

Agen Discover AI agent discovery flow: any identity provider, productivity suites and assistants, cloud, gateway, endpoints, and MCP server registries all feed one agent registry where every AI agent is inventoried, risk-scored on arrival, given a named human owner, and shadow AI is surfaced. — Discovery pulls from five surfaces into a single agent registry — no SDK self-registration required.

ClosesWhich agents are running that nobody registered?

no SDK required5 surfacesowner-mapped

Discover in depth →

Every request is evaluated against the identity behind the agent and answered in under 30ms: allow, mask, step up, hand to a human, or deny. The action is where the risk lives, so the action is where the decision happens.

Per-action verdicts anchored to the human behind the agent
Step-up and human-in-the-loop only when policy is crossed
Evidence generated at action time, not reconstructed later

Agen Govern runtime AI agent governance flow: an attempted action such as an assistant reading a document, an agent exporting records, or a custom agent writing to production is resolved to the identity behind the agent and checked against policy in 22 milliseconds, returning a per-action verdict of allow, mask, step-up, human-in-the-loop, or deny. — Every agent action is judged in-line against the human behind it, and answered in under 30ms.

ClosesWho approved this action, and who is accountable for it?

<30ms verdictstep-uphuman-in-the-loop

Govern in depth →

One policy plane enforced identically on the endpoint, in the browser, at the gateway, and in the cloud. Agent risk lives in the gaps between point tools, so there are no gaps to live in.

AgenShield stops dangerous local actions before they execute
BrowserShield catches company data at the paste (early access)
One policy, one identity chain, enforced the same way everywhere

Agen Shield AI agent enforcement flow: one policy plane written once in Govern and anchored to the same identity is enforced identically on the endpoint with AgenShield, in the browser with BrowserShield, at the gateway across 150+ connectors, and in the cloud across SaaS and internal apps. — One policy, written once, enforced the same way on every surface where agents actually run.

ClosesWhat happened on the laptop and in the browser that no log saw?

endpointbrowsergateway · cloud

Shield in depth →

FAQ

Questions, answered.

Does Agen replace Workspace and Gemini Enterprise admin controls?

No. Keep them. They govern who has the product and where data lives. Agen stops the leak at the paste, decides agent actions at the gateway, enforces on the device, and records all three.

Can Agen govern Gemini's grounding on Gmail and Drive?

Grounding happens inside Google's cloud, so no browser or gateway sits in that path. Agen surfaces which accounts and agents are in use. Per-action verdicts apply at the paste, to agents that reach your systems through the gateway, and to Gemini CLI on the device.

How are agents built in Gemini Enterprise governed?

Each one is discovered, assigned a named owner, and decided per action at the gateway for every connector it uses to reach your systems. Writes can require the owner's approval.

Is Gemini CLI covered?

Yes. It runs on developer machines and is governed on the device by AgenShield, with the same policy as Claude Code, Codex and Cursor.

Is BrowserShield generally available?