Gemini API Managed Agents: how to govern hooks, models and automation

Google’s update gives teams more ways to shape Managed Agents, but it does not make every agentic workflow ready for unattended production. On July 28, 2026, Google announced that antigravity-preview-05-2026 now uses Gemini 3.6 Flash by default. The same announcement highlights environment hooks, model selection, budget controls, scheduled triggers and free-tier access.

Google describes a managed interaction as capable of coordinating reasoning, code execution, package installation, file work and web retrieval within an isolated cloud sandbox. Those are confirmed product capabilities. They do not independently authorize confidential data, external credentials or actions with financial, legal or customer consequences.

CreatikLab’s operational guidance is to assign every capability a release condition. A selected model should pass a repeatable evaluation. Hooks should enforce a written rule rather than a vague intention. Automation should begin with a narrow task, an identified owner and a defined response when the output cannot be trusted.

• Confirmed by Google: Gemini 3.6 Flash is the default for the named preview agent.
• Confirmed by Google: hooks can surround tool calls inside the sandbox.
• Operational guidance: keep consequential actions behind explicit authorization and review.

The product announcement explains what Managed Agents can coordinate, but governance remains an organizational responsibility. Before connecting business data, draw the execution path from the initial instruction to the final export. Include files, tools, installed dependencies, retrieved web material and every external system that could receive an output.

1. List each permitted input, including prompts, files and retrieved material.
2. Classify tools as read-only, reversible write, irreversible write or external communication.
3. Identify which packages may be installed and who reviews changes.
4. Restrict the file locations the workflow may read, modify or export.
5. Record every credential and connector located outside the sandbox.
6. Assign owners for review, interruption, recovery and incident escalation.

Google calls the sandbox isolated. That description should not be expanded into a universal security or compliance conclusion. Each organization must decide which data categories are acceptable, how credentials are supplied and whether generated files or logs could expose sensitive material.

Reviewing only the final answer is insufficient. An accurate-looking report may still have been produced through an unacceptable command, dependency or retrieval step. Approval criteria should therefore cover both the result and the path used to create it.

Environment hooks are the most concrete governance mechanism in the announcement. Google says custom scripts can run before or after tool calls in the sandbox. The configuration uses .agents/hooks.json, with events for pre-execution and post-execution handling. Matchers can target selected tools or broader groups.

Google’s example includes a handler that can deny a proposed call before it runs. The rejected operation is skipped, and the reason can be returned to the model’s context. A later handler can inspect or format an output. Google also identifies HTTP-based handlers that communicate with an external endpoint.

The existence of a hook does not create a complete policy. Teams still need to decide which calls are normal, which require approval and what evidence must be retained. A rule that covers one command may leave another route open, so the policy should be tested against both ordinary and prohibited requests.

1. Observe attempted calls before introducing broad automation.
2. Create a short allowlist for the task being tested.
3. Reject unknown or destructive operations by default.
4. Check expected outputs after tool execution.
5. Store important audit evidence outside the agent’s editable files.
6. Test unavailable handlers, delayed responses and malformed results before launch.

Keep hook policies specific to a workflow. A repository audit and a marketing-file review do not need identical tools or exceptions. Smaller rule sets are easier to explain, evaluate and update when dependencies change.

Google states that the named preview agent adopts Gemini 3.6 Flash automatically on the next interaction. The integration may continue to run, yet its tool choices, outputs or timing may differ from a workflow evaluated against an earlier default. That makes regression testing necessary even when no API change is required.

Google characterizes Gemini 3.6 Flash as balanced for reasoning, coding and tool use. It also lists Gemini 3.5 Flash for previous-generation general agentic workflows and Gemini 3.5 Flash-Lite as the lower-latency, lower-cost choice within the Gemini 3.5 family. A model can be chosen explicitly through agent_config.model.

Those descriptions are selection guidance, not workload-specific results. CreatikLab recommends replaying the same evaluation cases across candidate configurations. Compare task completion, incorrect tool choices, expected refusals, review time and observed usage. If stability matters, pin the tested model and document what will trigger a new evaluation.

• Include routine cases, edge cases and forbidden requests.
• Retain failures so later versions must demonstrate that defects have not returned.
• Assess tool use and intermediate files, not only polished final prose.
• Repeat testing after changes to prompts, models, hooks, packages or tools.

Google announces budget controls for Managed Agents. That is useful as a product-level control point, but it should not be treated as a complete financial policy. Before relying on it, teams should verify the current configuration options, test them on the intended workload and monitor usage outside the agent’s own workspace.

Scheduled triggers raise a different question: whether a task is safe to run without a person initiating each execution. Start by scheduling only work that produces a proposal or report. Keep external writes disabled until inputs, outputs, ownership and recovery procedures have been tested repeatedly.

A recurring workflow also needs housekeeping rules. Decide which files are current, which outputs should be archived and how a reviewer can recognize an interrupted or stale run. These are CreatikLab recommendations for operating automation safely; they are not additional product behaviors attributed to Google.

• Measure representative runs before setting operational expectations.
• Keep aggregate usage monitoring separate from the managed task.
• Require a review path for partial, malformed or missing outputs.
• Start schedules in observation mode with no consequential external action.
• Define who can pause the workflow and how downstream users are notified.

A useful pilot begins with a task that has an objective acceptance test. A development team might ask an agent to inspect an approved repository copy and prepare a dependency-review report. The agent’s output would remain advisory while reviewers compare it with the established manual process.

Measure the complete workflow rather than a single impressive response. Record whether required sections are present, whether prohibited tools were attempted, how many corrections were needed and whether the result was ready for a knowledgeable reviewer. Keep unsuccessful cases in the evaluation set.

• Task success against criteria written before execution.
• Attempted, permitted and denied tool calls by category.
• Factual, structural and business-rule errors identified in review.
• Human corrections, approvals and recovery actions.
• Time from accepted input to a reviewable result.
• Observed usage associated with the whole workflow.
• Condition of files and connected systems after interruption.
• Operational usefulness without claiming guaranteed productivity or returns.

Segment observations by model, prompt version, hook version and tool configuration. An overall average can conceal a rare but serious failure. A launch decision should be based on the most consequential unresolved defect, not only on the median result.

Google’s Managed Agents announcement does not describe a native Google Ads connection or grant access to an advertising account. Any such connection would require a separate integration with its own authentication, permissions and operating rules.

A bounded experiment can use an approved campaign export in a controlled workspace. The task might check naming consistency, locate missing fields, group anomalies or prepare questions for a specialist. These are proposed implementation patterns from CreatikLab, not features promised by Google.

Keep the exercise separate from tools that can change bids, budgets, targeting or live creative. Even a technically consistent report still requires interpretation of campaign objectives, conversion quality, margins and brand constraints.

For human support with advertising strategy and account work, visit CreatikLab’s Google Ads service page. This route describes a service and does not imply that Google Ads functionality is included in Managed Agents.

1. Choose one narrow task with an objective acceptance test.
2. Map data, tools, packages, files and external connections.
3. Evaluate candidate models and pin the tested choice when needed.
4. Observe hook events before enabling automatic denials.
5. Use a limited allowlist and keep destructive actions unavailable.
6. Test budget controls without treating them as a total-cost guarantee.
7. Run scheduled work in proposal-only mode first.
8. Keep audit evidence outside the agent’s editable workspace.
9. Exercise interruptions, invalid outputs and unavailable dependencies.
10. Require human approval for material business effects.
11. Verify current project terms before committing to production.
12. Repeat the evaluation whenever the workflow changes.

Prepare a one-page brief containing the task, current tools, permitted data, intended frequency, acceptance test and prohibited actions. Then open MarketingPro, address the brief to Lia and ask for a scoped review of the Gemini workflow or advertising use case. Include the decision you need to make and the risks you want assessed so the conversation begins with a concrete request.

What changed in Gemini API Managed Agents?

Google announced that antigravity-preview-05-2026 now defaults to Gemini 3.6 Flash. It also highlighted environment hooks, explicit model selection, budget controls, scheduled triggers and free-tier access.

Does the default-model change require code changes?

Google says the named preview agent picks up Gemini 3.6 Flash on the next interaction without a code change. Teams can also select a supported model explicitly with agent_config.model.

What can environment hooks do?

Hooks can run custom handlers before or after tool calls in the sandbox. Google presents blocking, linting and auditing as example uses and documents command and HTTP handlers.

Do budget controls guarantee the total cost of a workflow?

No such guarantee should be inferred. Google announces budget controls, but teams should verify the current product terms and measure the complete workflow before setting operational expectations.

What does free-tier access establish?

It establishes that Google has added free-tier access to Managed Agents. It should not be treated by itself as a production pricing estimate or a promise that a particular workload will remain free.

Can Managed Agents directly operate Google Ads campaigns?

The announcement does not describe a native Google Ads integration. Any account connection would need separate authorization, permissions and controls. An approved read-only export is a more bounded starting point.