5.4 Agent Registry, App Hub & Enterprise Governance

The VaultBank Governance Crisis: Attack of the “Shadow Agents”

Six months after launching the Wire-Transfer Agent, VaultBank’s Chief Information Security Officer (CISO) discovers a nightmare: 14 different engineering teams have quietly deployed 45 undocumented AI agents and 20 random MCP servers across different GCP projects! Nobody knows which agents have access to customer data, who owns them, or what happens if a legacy MCP server goes down.

1. The 60-Second Anchor

Securing a single agent at the perimeter (5.1), identity layer (5.2), and callback layer (5.3) isn’t enough when an enterprise scales to dozens of agents. You need Enterprise Fleet Governance:

• Application Design Center (ADC): The Pre-Approved Blueprint Catalog. Instead of letting developers wire up random cloud resources from scratch, platform admins publish security-hardened, compliant architecture templates in ADC.
• App Hub: The Application Topology Map. It groups underlying GCP resources (Cloud Run services, Agent Runtime instances, databases) into logical business applications with clear Owners, Criticality, and Environment tags (Prod vs. Dev).
• Agent Registry: The Centralized AI Directory (“Yellow Pages”). It catalogs every deployed Agent (ADK, A2A Agent Cards) and MCP Tool Server across your organization so teams can discover approved tools, prevent duplicate “shadow agents,” and govern semantic metadata in one place!

---

2. Visual Blueprint: The Enterprise Governance Lifecycle

Here is how Google Cloud connects pre-deployment blueprints, infrastructure topology, and agent discovery into one unified governance loop:

Phase 1: Design & Standardize

Application Design Center

Platform architects publish pre-hardened templates (with VPC-SC, Model Armor, and least-privilege IAM baked in) so teams deploy compliant agents from day one.

Phase 2: Map Topology

App Hub Application Model

Links deployed Agent Runtime services, Cloud Run backends, and databases into a single logical “VaultBank Retail App” with assigned business owners.

Phase 3: Catalog & Discover

Agent Registry (Central Hub)

Registers all enterprise Agents (A2A Agent Cards) and MCP Tool Servers with rich semantic descriptions, version tags, and approved authentication policies.

---

3. How Agent Registry Eliminates “Shadow AI” & Tool Sprawl

1. Centralized Discovery of Agents & MCP Servers Before building a new tool from scratch, VaultBank developers search Agent Registry to find existing, security-vetted MCP servers (like the official VaultBank Fraud-Check MCP Server) and partner A2A agents.

2. Semantic Governance & Version Control Why do agents hallucinate and pick the wrong tool? Because two tools have vague or overlapping descriptions! Agent Registry enforces clear semantic metadata, input/output schemas, and version tracking so orchestrator agents always route tasks to the right sub-agent or tool.

3. Blast-Radius & Dependency Tracking via App Hub Because Agent Registry integrates directly with App Hub, VaultBank’s CISO can instantly answer: “If the Core Banking MCP Server goes down or has a vulnerability, which business applications and AI agents are impacted, and which VP owns them?”

4. Revoking Rogue or Deprecated Agents If an older agent version fails a security audit, admins can deprecate or revoke its registration in Agent Registry and block its Agent Identity at the Agent Gateway—cutting off traffic across the entire enterprise immediately.

---

4. High-Yield Exam Matrix: Governance Tool Selection

Exam Scenario Requirement	Winning Google Cloud Service	Why Distractors Fail
“Prevent teams from deploying unapproved agent infrastructure configurations.”	Application Design Center (ADC)	ADC provides reusable, governance-approved infrastructure and application templates before deployment.
“Track business ownership, environment (Prod/Dev), and service dependencies for deployed cloud workloads.”	App Hub	App Hub organizes raw infrastructure resources into logical applications and maps operational dependencies.
“Maintain a central catalog of available A2A agents, Agent Cards, and MCP tool servers for reuse and IT visibility.”	Agent Registry	Agent Registry is purpose-built for discovering, governing, and cataloging agentic endpoints and MCP tools.
“Ensure multi-agent orchestrators accurately select the right sub-agent without routing confusion.”	Semantic Metadata Governance (in Agent Cards & Registry)	Clear, non-overlapping capability descriptions in the A2A Agent Card and Agent Registry prevent LLM routing errors.

Golden Rule for the Exam

Application Design Center standardizes architecture before deployment, App Hub maps infrastructure ownership and blast radius, and Agent Registry catalogs your AI agents and MCP tools for safe discovery!