How to enforce tool-level scope limits on Google Antigravity agents

Google Antigravity
,
1

Hi everyone,

I’ve been building autonomous agents using the Google Antigravity SDK and Gemini. One challenge when letting agents execute tools asynchronously in production is ensuring they don’t perform unauthorized actions (e.g. running destructive CLI commands or mutating database rows outside their permitted scope) if the model drifts or behaves unexpectedly.

By default, Antigravity has conservative policies (like blocking run_command unless explicitly allowed), but if you have complex custom tools, you need a way to verify active permissions dynamically at runtime.

To solve this, I built a setup that integrates X.509 compliance checking with the SDK’s lifecycle hooks. It intercepts tool calls and validates agent scopes against an API registry before execution:

  1. Map your tools to required permission scopes:
tool_scopes_mapping = {
    "query_market_prices": ["market.read"],
    "execute_market_trade": ["trade.execute"],
}
  1. Register a pre-tool decide hook in your LocalAgentConfig to act as a compliance gate:

from google.antigravity import Agent, LocalAgentConfig
from kakunin.integrations.google_antigravity import get_kakunin_hooks

Dynamically load auditing and pre-flight scope hooks

hooks = get_kakunin_hooks(
kakunin=kakunin_client,
agent_id=“your-agent-id”,
tool_scopes_mapping=tool_scopes_mapping,
)

config = LocalAgentConfig(
model=“gemini-3.5-flash”,
tools=[query_market_prices, execute_market_trade],
hooks=hooks,
)

If the agent tries to run a tool it isn’t authorized for, or if the agent’s certificate has been revoked mid-session, the hook raises a ScopeViolationError and halts the process before any tool logic or token execution runs.

I’ve uploaded a full working quickstart and Jupyter Notebook showcasing this configuration here: https://github.com/nqzai/kakunin-samples/tree/main/google-antigravity

Hope this helps anyone looking to run autonomous Antigravity agents with stronger runtime guardrails! Feel free to ask if you’ve done something similar or have questions on the hooks implementation.