Ninety-six percent of enterprises already run AI agents in production. Only 12% say they can actually govern them, according to a 2026 OutSystems survey of 1,900 IT leaders. That gap — not benchmark scores, not context windows, not reasoning quality — is the contest Google designed its Gemini Enterprise Agent Platform to win. Three months after the platform’s April 22 launch at Google Cloud Next ’26 in Las Vegas, competitive dynamics are crystallizing fast: OpenAI’s Workspace Agents moved to credit-based billing on July 6, the free-preview window on ChatGPT Work closed, and Anthropic’s Claude Cowork expanded from desktop to web and mobile on July 7. The enterprise agentic AI market has reached a pricing and governance inflection point, and every team deploying autonomous agents now has real operating costs, real security exposures, and a real decision to make about which infrastructure layer will govern their agent estate.

The platform Google launched at Cloud Next ’26 is the successor to Vertex AI — a retirement Google made explicit: all future Vertex AI roadmap evolutions will be delivered under the Gemini Enterprise Agent Platform brand, ending the standalone Vertex AI product line.

Most Enterprise Agents Run Without Governance Infrastructure

The figures behind Google’s bet deserve a close reading, because they define the market the platform is entering. A 2026 OutSystems survey of 1,900 IT leaders found that 97% of organizations are already exploring agentic AI strategies, and 49% describe their own capabilities as advanced or expert — yet only 36% have a centralized approach to governance, and just 12% use a centralized platform to maintain control over AI sprawl. Gartner’s 2026 Hype Cycle for Agentic AI frames the same tension differently: only 17% of organizations have deployed AI agents to date, yet more than 60% expect to do so within two years — the most aggressive adoption curve Gartner has recorded for any emerging technology in the survey’s history. The hype cycle places agentic AI squarely at the Peak of Inflated Expectations, with governance, security, and cost-management capabilities still maturing well behind deployment intent.

The governance gap is not primarily a policy problem. It is an identity architecture problem. AI agents with persistent access to corporate data, email, calendars, CRM systems, and internal APIs are effectively non-human insiders operating at machine speed. Traditional identity and access management frameworks were designed for humans who act sequentially and whose actions can be observed in real time. OWASP’s Top 10 for Agentic Applications 2026 identifies goal hijacking, tool misuse, and identity privilege abuse as the core threats for autonomous systems — and notes that agents exceeding their intended scope can have significant, even catastrophic, consequences. Forrester Research has predicted that 25% of planned enterprise AI spending in 2026 will be deferred to 2027 as CFOs demand ROI evidence and security teams flag unresolved governance gaps.

This is the problem Google has engineered Gemini Enterprise to address — at the infrastructure layer, not the application layer.

Agent Identity: Governance Built Into the Foundation

The clearest signal of Google’s strategy is not what the platform can do, but where it places its controls. Where Anthropic and OpenAI have largely positioned governance at the application tier — role-based access controls, admin dashboards, organization-level settings — Gemini Enterprise places two foundational primitives below the application entirely.

Agent Identity assigns every deployed agent a unique cryptographic identifier. Every API call, every data access request, every file operation the agent performs is signed, logged, and traceable to that identity. The architecture is conceptually identical to what organizations already apply to human employees through identity providers like Microsoft’s Entra ID — but applied to non-human actors running at machine speed. Agent Gateway sits alongside it as the central policy enforcement point: a connectivity layer that governs all agent interactions with tools and data sources, manages authentication across agent-to-tool calls, and applies security guardrails via integration with Google’s Model Armor content protection system.

A third primitive, Agent Registry, provides a centralized catalog for discovering, tracking, and managing all agents, tools, and MCP servers across the organization. When an enterprise has deployed hundreds of agents built by different teams across different business units, the registry is what prevents the shadow AI problem — where agents run without IT visibility — from becoming a security audit failure.

Google Cloud’s VP of Product Management Michael Gerstenhaber framed the architectural choice directly in the platform launch announcement: the original Vertex AI was designed for the complexity of the early generative AI era, but “today, we’re managing a different level of complexity with agents interacting across multiple systems — and often without security and governance guardrails.”

The compliance layer built on top of these primitives is substantial. Native integration with Google Cloud IAM provides granular least-privilege access controls over what data an agent can query or modify. Built-in Data Loss Prevention logging creates continuous visibility into model inputs and outputs. Regional data residency controls — available at the Enterprise tier — allow organizations to satisfy GDPR, HIPAA, NIS2, and EU AI Act Article 10 data governance requirements without custom engineering. The platform holds ISO 42001 certification, the international standard for AI Management Systems — meaning Google’s governance claims have been independently audited, not merely self-reported.

That ISO 42001 distinction matters more than it might appear. In a market where every major vendor claims enterprise-grade security and compliance, independent audit-based certification is the only claim a competitor cannot match simply by updating its marketing copy.

How Does the Agent Development Kit’s Graph Architecture Work?

The technical foundation for building on Gemini Enterprise is the Agent Development Kit, now at a stable 2.0 release following an update at Google I/O in May 2026. ADK 2.0 models agent orchestration as a graph — agents as nodes, decisions as edges, sub-agents as composable functions — and provides three core patterns for structuring that graph.

A SequentialAgent runs steps in a fixed pipeline: one agent’s output is another’s input, in deterministic order. A ParallelAgent fans work across concurrent sub-agents that share session state; the parent agent receives all sub-task results before continuing. A LoopAgent iterates a sub-agent until a defined condition is met, enabling the refinement cycles that knowledge work tasks typically require. All three write outputs to a shared state object rather than calling each other directly — a design choice that enforces explicit state boundaries and makes the execution path observable and debuggable in a way that earlier callback-based frameworks did not.

This architectural difference matters for enterprise production use. When an agent chain fails — and agent chains fail — the graph model produces a traceable execution record that lets an engineering team identify exactly which node failed, why, and what state it held at the point of failure. That is a significant improvement over architectures where failures cascade silently across a chain of callbacks with no natural audit point.

ADK 2.0 added native OpenTelemetry export, meaning agent execution traces can flow directly into existing enterprise observability platforms without custom integration work. It supports Python, TypeScript, Go, Java, and Kotlin — the full range of languages enterprise engineering teams actually use — and is open source under Apache 2.0, which gives organizations the option to inspect, modify, and audit the framework itself.

Agent Studio provides the low-code entry point for product managers and business analysts who need to build agents without writing code. When logic becomes complex enough to require it, Studio exports directly to ADK — a path from no-code to full-code that does not require rebuilding the agent from scratch.

For scale, Agent Runtime claims cold starts under one second and supports multi-day workflows — agents that remain active, reason, and respond to external events for extended periods without losing context. Memory Bank pairs with the runtime to generate and serve long-term memories with persistent session identifiers that can be mapped to records in a CRM or internal database.

Dedicated Inference Silicon Sets a Hardware Floor

Behind Gemini Enterprise’s governance and orchestration stack sits a hardware advantage none of its platform competitors can offer: purpose-built silicon for the inference workload specifically.

Google’s eighth-generation TPU 8i, announced alongside the platform at Cloud Next ’26, pairs 288 GB of high-bandwidth memory with 384 MB of on-chip SRAM — tripling the on-chip SRAM of the previous generation. It doubles interconnect bandwidth to 19.2 Tb/s for Mixture of Experts models, adds a new Collectives Acceleration Engine that reduces on-chip latency by up to five times, and connects 1,152 chips directly in a single pod. Google claims the result is 80% better performance-per-dollar on inference workloads compared with the previous generation. That figure comes from Google’s own benchmarking and has not been independently verified by third-party auditors.

The architectural significance is what makes this more than a routine chip announcement. Google has deliberately separated training silicon (TPU 8t, designed for compute-intensive model training at up to 9,600 chips per superpod) from inference silicon (TPU 8i, designed for low-latency live agent workloads). This split reflects a hard engineering reality: the memory footprint, interconnect topology, and latency tolerance of training and inference workloads are fundamentally different, and a chip optimized for one is not optimal for the other. For enterprises running high-concurrency agentic workflows — where hundreds of agent sessions may be processing simultaneously — inference latency directly affects user-facing response times and agent throughput.

Microsoft Azure AI Foundry and AWS Bedrock AgentCore run on NVIDIA GPUs, where customer workloads share capacity with a broad ecosystem of unrelated compute demands. Google’s TPU infrastructure is vertically integrated with its AI research and Gemini model development, giving it visibility into the model architectures it is optimizing for. The practical trade-off is CUDA ecosystem lock-in: enterprises that have built significant NVIDIA GPU toolchains may find Google’s TPU infrastructure requires operational re-platforming.

Where Each Competitor Has the Advantage

The competitive landscape in enterprise agentic AI platforms sorted into four distinct strategies by mid-2026, and understanding where each competitor wins matters more than picking a global best platform.

Microsoft Azure AI Foundry, paired with Agent 365 launched in November 2025, holds the identity advantage for the roughly 10,000+ enterprises already running Microsoft 365 and Entra ID. Agents built on Azure AI Foundry inherit existing identity, compliance, and data-loss-prevention policies from Entra ID on day one — without new infrastructure or migration work. The pricing model is per-seat (approximately $30 per seat plus $15 for Agent 365), which creates more predictable budget exposure than usage-based billing. For Microsoft-native organizations with strong Entra ID deployments, this is a meaningful structural advantage that Gemini Enterprise cannot replicate without asking those organizations to maintain two identity stacks.

AWS Bedrock AgentCore competes on model breadth: Claude (Anthropic), Llama (Meta), Mistral, Cohere, and Amazon Nova through a single API, governed by AWS IAM per-service controls rather than a unified agent control plane. For AWS-native engineering cultures and teams that need multi-framework model flexibility, Bedrock’s approach is the natural fit — though the absence of a unified control plane means governance is assembled from AWS’s existing tooling rather than shipped as a first-class product.

Anthropic’s Claude Cowork reached general availability on April 9, 2026, then expanded from desktop to web and mobile on July 7 — driven, Anthropic says, by analysis showing over 90% of 1.2 million anonymized Cowork sessions had nothing to do with software development. The enterprise tier at $100 per user per month includes SOC 2 compliance and custom VM configurations. Cowork’s strength is task execution for individual knowledge workers — it has built-in integrations with Google Workspace, Salesforce, Docusign, and legal platforms. Governance and observability are largely delegated to third parties, which limits its appeal to compliance-focused IT functions but reduces implementation friction for teams that want to move fast.

OpenAI’s path took a significant turn on July 6, when Workspace Agents moved from free preview to credit-based pricing: each agent run is metered across input tokens, cached input tokens, and output tokens, with a typical GPT-5.5 run landing in the range of 5 to 25 credits per OpenAI’s published rate card. ChatGPT Work launched on July 9 as the broader packaging of these capabilities. Teams that spent the spring wiring workspace agents into daily operations now have a variable operating cost where they had none — a pricing structure that makes agent usage a FinOps problem, not just an engineering one. OpenAI’s governance story remains at the application tier: role-based controls and admin dashboards, without infrastructure-level agent identity or a dedicated policy enforcement gateway.

What Gemini Enterprise offers that none of its current competitors match at the same depth is the combination of infrastructure-level governance, multi-model flexibility, and dedicated inference hardware. Whether that combination translates into enterprise wins will depend on whether CISOs prove as decisive a buyer as Google is betting they are.

What Enterprise Teams Should Ask Before Choosing a Platform

The governance gap — 96% deploying, 12% governing — is closing faster than most organizations have budgeted for. Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% in 2025. The teams that begin evaluating platforms on governance depth now will be ahead of the compliance and security questions that arrive when those agents go live with persistent access to sensitive data.

The relevant evaluation questions are not “which model scores highest on a benchmark” but: Does this platform assign a traceable cryptographic identity to every agent action? Does it enforce least-privilege access between agents and data sources at the infrastructure layer, or only at the application layer? Does it provide a single policy enforcement point that covers agent-to-tool calls across cloud, on-premises, and edge environments? Can it be audited independently — not just configured through a self-reported compliance checklist?

Gemini Enterprise answers yes to all four. Azure AI Foundry answers yes to identity, with the caveat that the identity advantage applies only to organizations already in the Microsoft ecosystem. AWS Bedrock AgentCore’s governance is distributed across service-level IAM controls without a unified agent control plane. Anthropic’s Cowork and OpenAI’s ChatGPT Work remain primarily at the application tier.

The Grok 4.1 model family deprecation on the Gemini Enterprise Agent Platform, announced July 17 with a shutdown deadline of August 20, provides a practical near-term test of the platform’s production reliability for teams that currently call those model IDs. Migrating to Grok 4.2, Grok 4.3, or an alternative Model Garden offering is a straightforward API change — but it illustrates the ongoing operational overhead of any multi-model platform as the model landscape continues to evolve.

For enterprises whose agent deployments are primarily for productivity — document drafting, research, scheduling — the choice between Anthropic’s Cowork and Google’s Gemini Enterprise app depends mainly on budget tolerance and existing cloud commitments. For enterprises whose agents will have persistent access to customer records, financial data, or regulated health information, the governance infrastructure question is not optional, and the platform decision is more consequential than any individual model quality difference.

Frequently Asked QuestionsWhat makes Google’s Gemini Enterprise Agent Platform different from Microsoft Azure AI Foundry?

The core architectural difference is where governance lives. Gemini Enterprise places Agent Identity (cryptographic identifiers for every agent action) and Agent Gateway (a unified policy enforcement point) below the application tier as infrastructure primitives, so governance is enforced regardless of how an agent was built or by whom. Azure AI Foundry’s comparable advantage is identity inheritance: enterprises already on Microsoft 365 and Entra ID get governance derived from their existing identity policies without additional integration. Teams already deeply invested in the Microsoft ecosystem will often find Azure AI Foundry’s day-one identity coverage easier to stand up; teams building from scratch on Google Cloud will find Gemini Enterprise’s dedicated governance stack more architecturally complete.

Why does it matter whether governance is at the infrastructure layer versus the application layer?

An agent that bypasses its application-tier controls — through a prompt injection attack embedded in a document it reads, through a misconfigured tool connection, or through a bug in the orchestration logic — still reaches the data it should not access if there is no policy enforcement below the application. Infrastructure-level governance enforces access controls before any application code executes, which means it catches the failures that application-tier controls miss. OWASP’s 2026 agentic security guidance identifies privilege escalation through over-permissioning as one of the core structural risks for enterprise AI agents — the infrastructure-layer approach to Agent Identity and Agent Gateway is the architectural answer to that specific threat.

Can enterprises run models other than Gemini on the Gemini Enterprise Agent Platform?

Yes — this is a deliberate design choice and a meaningful differentiator. The platform’s Model Garden exposes over 200 models, including Anthropic’s Claude Opus 4.8, Grok models from xAI, Llama, Mistral, Qwen, and DeepSeek open-weight models alongside Google’s own Gemini 3.1 Pro, Gemini 3.5 Flash, Gemma 4, and Lyria 3 for audio. A single agent can call different models for different sub-tasks while maintaining a unified identity, policy, and audit trail. The one near-term constraint: the Grok 4.1 model family has been deprecated as of July 17, 2026, with a shutdown deadline of August 20, requiring teams using those specific model IDs to migrate to Grok 4.2 or 4.3 before that date.

Which enterprise AI agent platform is best for a team worried about AI agent security?

The honest answer depends on your existing infrastructure. Teams already on Microsoft 365 and Entra ID get the fastest security baseline from Azure AI Foundry, because existing IAM and DLP policies extend to agents without additional configuration. Teams building from scratch, or those in regulated industries needing independent audit evidence, will find Gemini Enterprise’s ISO 42001 certification and cryptographic Agent Identity architecture the most defensible governance posture. Teams prioritizing deployment speed over security depth and whose agent use cases are limited to knowledge work productivity — not access to regulated data — can move faster with Anthropic’s Cowork or OpenAI’s ChatGPT Work, accepting that governance will need to be layered in as the deployment scales. For a broader view of enterprise agent security gaps, the Gravitee State of AI Agent Security 2026 report documents how the majority of organizations currently handle — or fail to handle — agent identity and access controls.