Skip to content
Get packs

Apigee Agent Gateway Governance

Builds an Apigee inspection proxy that meters, identifies and screens an agent's LLM traffic via Agent Gateway

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
15 files

What it does

This skill teaches an AI agent to set up an Apigee proxy that sits beside a Google Cloud Agent Gateway as a processor. The gateway hands it each LLM request and response, and the proxy returns a verdict without forwarding traffic to a backend. It can meter token use per model, extract caller identity, and apply Model Armor prompt screening or a semantic cache. The agent generates the proxy from a template and runs deployment scripts, with a planning and approval step before changes.

Great for

  • Platform engineers who already run a Google Cloud Agent Gateway and want to govern agent-to-LLM traffic
  • Teams that need per-model token metering or caller identity on AI model calls
  • Developers debugging a callout proxy that returns no verdict

Skip it if

  • Routing requests to a backend or hosting an MCP server behind Apigee, which needs a proxy with a target instead, not this inspect-only design
  • Changing which model a request goes to, or governing tool and MCP calls, which the skill explicitly excludes
  • Apigee hybrid or creating the Agent Gateway itself; running it against production without reviewing the approval plan risks changing resources the user already owns

Try asking

  • “Set up Apigee as an ext-proc callout on my agent's Gateway to meter token usage per model”
  • “Add Model Armor prompt screening to the LLM traffic my agent sends through Agent Gateway”
  • “Our callout proxy returns no verdict from Agent Gateway; help me find out why”
  • “Generate the Apigee proxy from my apigee-agent-gateway-governance input file and deploy it”
Step-by-step guide: how to use Apigee Agent Gateway GovernanceInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 15 original files, the Apache-2.0 licence and an attribution note.

    apigee-agent-gateway-governance.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip apigee-agent-gateway-governance.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip apigee-agent-gateway-governance.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the deploy script without --yes first to review the plan, especially any yellow APPEND or MODIFY rows that change existing resources
  • Set GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES to False in the agent's env_vars, or every invocation fails with 401
  • Keep the input file under version control and regenerate the proxy rather than hand-editing it

What's inside

  • assets/apigee-agent-gateway-governance.example.yaml
  • assets/apigee-proxy-template.yaml
  • assets/authz-extension.example.yaml
  • assets/authz-policy.example.yaml
  • assets/feature-identity.yaml
  • assets/feature-model-armor.yaml
  • assets/feature-normalize.yaml
  • assets/feature-semantic-cache.yaml
  • assets/feature-token-enforce.yaml
  • assets/feature-token-metering.yaml
  • references/attribution.md
  • references/gotchas.md
  • references/modes.md
  • references/networking-psc.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.