Google Adds Hooks to Gemini Managed Agents: Tools Can Be Blocked, But Failures Default to Allow

On July 28, Google shipped a major update to the Gemini API Managed Agents. The default model is now Gemini 3.6 Flash, alongside model selection, a free tier, total token budgets, scheduled triggers, and an Environments API.

These features are all practical, but the one that truly changes engineering boundaries is environment hooks.

Tool Calls Now Have a Front Door and a Back Door

Developers can register two types of events in a sandbox-level .agents/hooks.json file:

• pre_tool_execution: a script or HTTP request runs before tool execution and can return deny, canceling the tool call outright;
• post_tool_execution: runs after the tool finishes for formatting, testing, auditing, or telemetry — it cannot undo actions already taken.

Matchers use regex to target tools, for example intercepting code_execution|write_file, or * to cover all built-in tools. Handlers come in two flavors: sandbox-internal commands, and HTTP hooks sent to external HTTPS endpoints.

A common pattern: check paths and commands before writing files, then automatically run lint and unit tests after. When the model is denied, the rejection reason returns to its context, and it can try another route.

*This* is what production systems look like.

The Real Value: Encoding Process into the Runtime

Discussions of agent harnesses often stop at prompts, tool schemas, and context organization. Google has now pinned policy points to every tool call, before and after. Security, quality, and compliance no longer depend on the model "remembering the rules" — the runtime steps in.

Google's official investment-banking example is concrete: after an agent generates a list of acquirers, a post hook automatically fetches logos, checks dimensions and transparent backgrounds, verifies them with a vision model, and only allows images that pass into the presentation. The value here isn't a smarter model — it's a repeatable quality gate.

The same update also fills in three long-running agent gaps:

• max_total_tokens caps total input, output, and thinking token consumption;
• once the budget is exhausted, the task pauses as incomplete, sandbox state is preserved, and execution can resume after topping up;
• scheduled triggers bind the agent, environment, prompt, and cron schedule into a long-lived resource that reuses the same sandbox, so files persist.

Together with the Environments API (list, inspect, and delete sandboxes), Managed Agents has evolved from one-shot invocations into stateful background workers.

But This Safety Gate Is "Fail-Open"

The official documentation is explicit: if a hook script crashes, the HTTP call returns non-2xx, times out, or returns unrecognizable JSON, the runtime treats it as allow. Fail-open avoids a broken linter deadlocking the business, but it disqualifies hooks as a final security boundary.

Two more limitations:

1. Hooks only intercept sandbox built-in tools (code execution, file read/write, etc.); external MCP servers and custom functions are not covered; 2. An agent with file-write or code-execution permissions could modify hooks.json itself. Google recommends mounting the config from a read-only repository.

So hooks are better understood as operational guardrails, not tamper-proof mandatory access control. High-risk commands should still be backstopped by container permissions, network isolation, least-privilege credentials, and external approval flows.

My Take

The signals from the past week form a line: GitHub is talking up harness workflows, OpenAI is embedding security scanning pre-commit, and Google is putting hooks into every tool call. The competitive position of model companies is shifting from "whose model writes better code" to "whose runtime can govern code agents."

The next round of enterprise procurement questions will be blunt: Can it block? What happens when interception fails? Can budgets be resumed? Where does state live? Who can audit?

These questions aren't glamorous. But they determine whether agents make it into production.

Original sources

• Google's official update: https://blog.google/innovation-and-ai/technology/developers-tools/expanding-managed-agents-gemini-api-3-6-flash-hooks
• Agent hooks docs: https://ai.google.dev/gemini-api/docs/agent-hooks
• Managed Agents docs: https://ai.google.dev/gemini-api/docs/agents