Semantic Governance Policies is a managed control on Gemini Enterprise Agent Platform that places a natural-language policy engine in front of an agent’s tool execution. Google describes it as LLM-based: at the moment the model proposes a tool call, the engine evaluates the tool and the proposed parameters against the user prompt, the conversation history and the configured policies, and returns a verdict. It is enforced through Agent Gateway, outside the agent’s own code.
In Build zero-trust AI agents that judge intent, not just syntax it is the answer to requests that pass every syntactic check but violate business intent. The post’s example is a polite request to refund a 30 non-refundable without manager approval. Because the request never says “software”, the post argues, keyword matching and regex filters miss it, and a SQL parser has no way to know the item is digital software.
Capabilities
Policies are written as plain-text constraints attached to target tools, so that — in the post’s words — a business owner can read and change them; the example policy denies refunds for opened digital goods, software licenses or clearance items over 30 USD and routes them to a human manager, with enforcement set to block. When the engine returns DENY, tool execution is suppressed before it runs — in the example, the signing key is never called and the ledger is untouched — and the agent explains the outcome to the user. Each evaluation is recorded in the Cloud Logging event stream with the tool, a rationale and the verdict. The post notes that the reason for a denial can be configured not to be disclosed.
The post states that Semantic Governance applies regardless of how the agent accesses the tool: directly in code within the agent, or remotely through an API endpoint or an MCP server.
Adoption & Ecosystem
Because policies are evaluated dynamically at runtime, the post uses them to close the loop on attacks found by Agent Anomaly Detection: an administrator reviews the flagged trace in the Semantic Governance Policies experience and authors a new constraint covering the pattern, or an automated process creates one through APIs, and the new policy applies on the next tool call without modifying, redeploying or restarting the agent. Its example remediation denies any further refund for an order that already had an approved refund in the same session.
The post positions it between Model Armor, which filters the payload, and anomaly detection, which watches behaviour over time, and notes that single-turn evaluation of this kind cannot on its own see an exploit split across many individually permitted turns. It also presents moving such checks to the platform as shifting their ownership to a platform or security administrator, separate from the agent developer.