Today ainotis Join

My notis

SafetyPublished Top storyAll news from that day

Google Cloud's Auth Manager for AI agents is now generally available

Google says Auth Manager automates OAuth sign-in and token refresh for AI agents; JWT support for Agent Identity, a Model Armor topic detector and CodeMender sandboxing are in preview.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

Share

Check our sources · 6 facts from 1 source
Illustration: A wall-mounted access gate with a slim card reader and a sliding lock bolt; the green reader and bolt stand for automated sign-in for AI agents.Illustration made with AI for ai notis
source · Illustration made with AI for ai notis; not a picture of what happened

Key points

  1. Google Cloud says Auth Manager became generally available on 5 November 2026; it automates OAuth 2.0 and PKCE flows and refreshes user-delegated tokens for AI agents.
  2. Google says Agent Identity JWT support, in preview, issues OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.
  3. Also in preview: Workload Identity Federation for GKE in VPC Service Controls, Cloud Armor exploit-protection rules, a Model Armor custom topic detector and sandboxed CodeMender verification.

What happened

Google Cloud made Auth Manager generally available on 5 November 2026. It automates OAuth 2.0 and PKCE flows and refreshes user-delegated tokens for AI agents, which Google says reduces consent fatigue and the theft of credentials.

The release comes in a Google Cloud security blog post of the same date. Alongside Auth Manager, Agent Identity JWT support is in preview. Google says it issues standard OIDC tokens so agents can authenticate across AWS, Azure, on-premises backends and MCP servers without static, long-lived API keys.

Two network controls are generally available: IAM roles in VPC Service Controls ingress and egress rules, and the Cloud NGFW advanced malware sandbox, which Google says is enabled by Palo Alto Networks WildFire.

In preview are Workload Identity Federation for GKE in VPC Service Controls, Cloud Armor managed rules for exploit protection, and a Model Armor custom topic detector that lets teams enforce topic adherence for agents.

Google also lists new CodeMender capabilities in preview. CodeMender can now run vulnerability verification and exploit simulation inside an operating-system-level sandbox or an isolated virtual machine, and can scan a folder, a whole repository or only files changed since the last scan.

What it means for you

Our view

If you build or buy agents that act on a user's behalf in Google Cloud, Auth Manager is the part of this release Google says is generally available, and it handles the sign-in and token refresh work that Google says otherwise causes consent fatigue and credential theft.

The Agent Identity JWT support, Model Armor detector and CodeMender sandboxing are previews, so they are worth testing but not yet worth building production on. Check which of your agents authenticate with static, long-lived API keys today, and list which of those flows the preview JWT support would replace.

It adds no new facts.

Share this story

Your reaction

We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.

Check our sources

Every sentence above is checked against this source.

1 Helping you build and defend at machine-speed in the agentic eraGoogle Cloud · 5 Nov 2026 · 6 facts Open the source archived copy

  1. Google Cloud's blog post of 5 November 2026 says Auth Manager is now generally available and automates OAuth 2.0/PKCE flows and refreshes user-delegated tokens to minimize consent fatigue and reduce credential theft. the company says

    Now generally available, Auth Manager automates OAuth 2.0/PKCE flows and refreshes user-delegated tokens to minimize consent fatigue and reduce credential theft.
    cite

  2. The post says Agent Identity JWT support, now in preview, issues standard OIDC tokens, allowing agents to authenticate across AWS, Azure, on-premises backends, and MCP servers without static, long-lived API keys. the company says

    Alongside Auth Manager, Agent Identity JWT support, now in preview, issues standard OIDC tokens, allowing agents to authenticate securely across AWS, Azure, on-premises backends, and MCP servers without static, long-lived API keys.
    cite

  3. The post lists IAM roles in VPC Service Controls ingress and egress rules as generally available, and Workload Identity Federation for GKE in VPC Service Controls as in preview. the company says

    VPC-SC ingress and egress rules now support IAM roles, generally available, and Workload Identity Federation for GKE, in preview
    cite

  4. The post lists the Cloud NGFW advanced malware sandbox, enabled by Palo Alto Networks WildFire, as generally available, and Cloud Armor managed rules for exploit protection as available in preview. the company says

    you can now protect workloads with the new Cloud NGFW advanced malware sandbox, generally available, enabled by Palo Alto Networks WildFire, streamline firewall operations using Cloud NGFW project-level resources, generally available, and automate exploit protection with Cloud Armor managed rules, available in preview
    cite

  5. The post says a Model Armor custom topic detector, available in preview, enables teams to enforce topic adherence for agents. the company says

    Model Armor custom topic detector: This new enhancement, available in preview, enables you to enforce topic adherence for agents.
    cite

  6. The post says that in preview, CodeMender isolates vulnerability verification and exploit simulation inside an operating system-level sandbox or isolated virtual machine, and can scan a specific folder, an entire repository, or only files modified since the last scan. the company says

    Currently in preview, CodeMender delivers new capabilities for secure isolation and flexible scanning: Secure autonomous remediation: CodeMender isolates vulnerability verification and exploit simulation inside your choice of operating system-level sandbox or isolated virtual machine ... CodeMender now allows you to scan a specific folder, entire repository, or only modified files since the last scan
    cite

Topics

The morning email

On the mornings we publish: the three top stories and up to four short ones. Free.

We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep