Model Armor is a Google Cloud service that Google describes as an in-line AI firewall: it screens prompts and responses for prompt injection, jailbreaks, malicious URLs and sensitive data leakage. In Build zero-trust AI agents that judge intent, not just syntax it is one of three managed runtime controls on Gemini Enterprise Agent Platform, applied through Agent Gateway, the runtime enforcement point that intercepts interactions between the user, the agent, its model and its tools.
The post presents it as the replacement for a hand-maintained list of jailbreak phrases: maintaining regex dictionaries for every obfuscated jailbreak, it argues, fails quickly in production.
Capabilities
At ingress, Model Armor screens the payload at the perimeter before the agent’s reasoning loop runs. On the platform, Agent Gateway applies a Model Armor template directly in the request path, so the developer does not write the screening call; the post shows the underlying API call, which sends the user prompt against a named template and receives a sanitization result. When a filter matches, the request is dropped at the edge with a 403 — the agent’s model is never invoked, so no tokens are consumed and the context window stays clean. The post notes that Model Armor templates are regional.
At egress, it runs Sensitive Data Protection on outgoing responses, redacting values such as credit card numbers, Stripe secrets and employee IDs before they leave the gateway.
Adoption & Ecosystem
In the post’s layered design, Model Armor filters the payload, while Semantic Governance Policies reason about the intent of each proposed tool call and Agent Anomaly Detection watches behaviour over a session. The post’s own example shows the limit of payload screening: a polite, syntactically clean social-engineering request carries no jailbreak signal, so Model Armor allows it and the decision falls to the policy engine.