The October 8, 2026, announcement of the Gemini agent introduced a vision for a single, universal agent for work. As a product story, it is a private preview with no firm availability date. As an infrastructure story, it is a finished governance stack. Google has answered the agent-registry gap with a complete set of controls: cryptographically attested per-agent identity, OAuth-mapped authorization, agent-attributed audit, sandboxed execution, and Agent Gateway policy-once runtime enforcement.
This stack is delivered inside a walled preview where every registry is a Google-run vendor registry. Google’s announcement details an enterprise tools registry so teams can build and publish tools for the rest of the company, and a shared company skills registry where teams build and publish custom skills. The cross-vendor layer that would make a governed agent mean the same thing at a second company, such as the A2A registry formal spec or the Personal Agent Protocol v0.1, has not shipped. What a buyer can verify today stops at the boundary of the second vendor.
The Gemini agent remains in private preview, with wide availability for Workspace customers described only as coming soon and no firm date. That status is consistent with the broader landscape, where consolidation plays are moving faster than the open standards meant to connect them. As noted in our coverage of Google’s consolidation play, the infrastructure is maturing rapidly, yet the three promised specs and the divergence of independent registry implementations keep the fragmentation in plain view. The unshipped specs wrap confirms the industry is still waiting for a unified path forward.
The tension between proprietary control planes and open standards will be the central theme at AGNTCon+MCPCon, taking place October 22-23 in San Jose. The program stages the control-plane question directly, with Google’s unified control tower framing set against the open-standards working groups. As we mapped in our AGNTCon+MCPCon track analysis, the specs that would connect these disparate systems remain unshipped.
Governance is not merely a security feature; it is a financial necessity. According to PYMNTS Intelligence data from September 2026, 93% of merchants believe AI or agent providers should bear the financial loss when an agent makes an incorrect purchase, yet only 28% are willing to offer their full product range under current terms. That liability asymmetry is why identity and signaling are being standardized ahead of settlement. As discussed in our identity-first framing, spend caps and per-project chargeback are governance features that let organizations manage risk while scaling.
The technical implementation is where this gets concrete. Every agent receives its own identity, cryptographically attested and stamped into logs and into any virtual machine it spins up to run code. When an agent connects to an external system, that identity is mapped and propagated through standards like OAuth. Every action Gemini takes is written to an audit trail and “attributed to the agent rather than a person.” Enforcement sits at the network boundary: agents execute inside an Agent Sandbox with its own network boundary, all traffic passes through Agent Gateway, and in Google’s own description “You write the policy once” and it applies to every agent in the company. What Google’s post does not specify is how that policy would propagate when an agent crosses into non-Google systems. The MCP connectivity is real and documented; the A2A registry ratification is not, and no formal spec carries a date.
Coupling an organization to a vendor governance stack today is a bet that its semantics survive the eventual arrival of industry-wide specs. With per-token prices having dropped 98% since 2024, the incentive is to push volume onto whoever owns the enforcement layer. Sierra has said only that the PAP v0.1 specification lands later this month, and as of October 12 the text is unpublished. What the industry is waiting on is concrete: the PAP v0.1 text, a firm wide-availability date for the Gemini agent, and registry alignment on the AI Catalog and ARD path before the incompatible implementations diverge past the point of repair.