Google Cloud: new guidance from the State of AI infrastructure report — focus on governance and provenance

What changed: Google Cloud published a post (August 24, 2026) tied to its State of AI infrastructure report that frames agent security as a top gating issue and recommends Secure AI Frameworks, platform‑level governance, task‑level provenance, and human‑in‑the‑loop checks to safely scale autonomous workflows.

Why it matters: For operators and buyers, this is a practical playbook: don’t bolt agents onto legacy access and logging — adopt platform capabilities that provide end‑to‑end audit trails, dynamic permissions, and automatic escalation points so agents can act without creating unmanaged risk.

Try/watch: Read the report’s recommended controls and map them to existing tools (identity, secrets, observability); start instrumenting task‑level traces and short‑lived permissions for any agent that performs changing actions (writes, payments, provisioning). Track vendor support for the report’s recommended controls.

Who pays if an agent buys without permission? AP2, NIST, and a congressional bill underline accountability gaps

What changed: A Fortune piece (republishing analysis on August 24, 2026) highlights real incidents and policy work — including Google’s Agent Payments Protocol (AP2), NIST’s concept work on agent identity/permission, and the AI AGENT Act (S.5051) — showing industry and regulators are converging on the need for verifiable, task‑bounded authorization records.

Why it matters: If your agents will perform financial or legal actions, you need a verifiable evidence chain (signed task authorizations, task references that travel with each request, tamper‑evident logs) so disputes can be resolved without long audits across disconnected systems. That’s operational risk that can hit customer trust and compliance fast.

Try/watch: For any agent that can commit funds or change entitlements, pilot a task‑reference approach (signed authorization + short lifetime + per‑action checks) and add tamper‑evident logging; monitor NIST guidance and the progress of AI AGENT Act language to anticipate contract and audit requirements.