Skip to content
Techestination

5.1 The Perimeter: Stopping the $50k Rogue Prompt

1. The 60-Second Anchor

Section titled “1. The 60-Second Anchor”

If your AI agent is a high-security bank vault, you never let strangers walk straight up to the vault door.

  • Agent Gateway is the armed security checkpoint at the front entrance of the building—every user message and partner agent request must pass through it first.
  • Model Armor is the high-tech X-ray scanner inside that checkpoint. It scans every incoming prompt and outgoing reply for threats before the AI brain (Gemini) ever sees a single word!

2. Interactive Simulator: Follow the Rogue Prompt at the Perimeter

Section titled “2. Interactive Simulator: Follow the Rogue Prompt at the Perimeter”

Switch between the 3 Exam Payload Scenarios below and click any node (or use Next / Prev) to see how Agent Gateway, Model Armor, and ADK Before-Model Callbacks handle each request:

Stage 1 / 4
1. Incoming TrafficPrompt / A2A / MCP2. Agent GatewayIngress Front Door3. Model ArmorSDP & Threat Scan4. ADK RuntimeBefore-Model Check
INGRESS PAYLOAD
1. Traffic Arrives at VaultBank
Single PII Redaction Mode
What Happens at This Stage
A customer types a message containing their credit card number to ask about a recent charge.
Exam Rule & Verdict
Only 1 Sensitive Data Protection (SDP) detector is triggered—watch how Model Armor handles it in Stage 3!

3. Step-by-Step Perimeter Summary

Section titled “3. Step-by-Step Perimeter Summary”

  1. Traffic Hits the Front Door (Agent Gateway) Instead of exposing your agent directly to the internet, all chat messages, A2A (Agent2Agent) requests, and MCP tool calls enter through Agent Gateway.

  2. The X-Ray Scan (Model Armor) Agent Gateway automatically forwards the message to a Model Armor Template to check for prompt injection, jailbreaks, harmful content, and sensitive data leaks. (Exam Note: To connect Agent Gateway to Model Armor, the gateway service identity needs the roles/modelarmor.calloutUser and roles/modelarmor.user IAM roles).

  3. The Verdict: Redact vs. Hard Block Model Armor decides in milliseconds whether to mask a single accidental PII leak and continue, or issue a full block when multiple threat detectors trigger together.

  4. The Runtime Gatekeeper (Before-Model Callback Logic) Even if a message passes the perimeter, the Agent Development Kit (ADK) runs a final built-in check called a Before-Model Callback right before calling Gemini:

    • Allow Action: If the callback returns Nothing (None), the prompt proceeds to the Gemini model normally.
    • Override Action: If the callback returns a Custom Response object (LlmResponse), ADK skips calling the Gemini model completely and replies with that custom message—saving tokens and stopping bad requests cold!

4. High-Yield Exam Traps (Spot the Difference!)

Section titled “4. High-Yield Exam Traps (Spot the Difference!)”
Scenario at VaultBank What Happens Under the Hood? Exam Takeaway
Customer accidentally types ONLY their credit card number Single Detector Match: Sensitive Data Protection (SDP) spots 1 PII type. Model Armor redacts/masks it and lets the chat continue. Single SDP match = De-identify & Continue
Hacker sends Prompt Injection + Credit Card leak together Multiple Detector Violations: Because more than one threat detector triggered at once, Model Armor refuses to just redact—it issues a Full Block. Multi-detector violation = Hard BLOCK
Partner Bank connects via A2A v1 vs. MCP Protocol Model Armor scans A2A v1 Send Message and Agent Card payloads, and MCP tools/call payloads. However, MCP tools/list bypasses sanitization! Scanned: tools/call (Yes) vs. tools/list (No)