AGENTMESH
agentmesh · running it from a google cloud shop

Your company runs on Google Cloud.
Here is exactly what the mesh touches.

Tom's week tells this story without naming a vendor. This page tells it for a Google shop: the agent you already have, the few places the mesh touches it, and a page in the menu for each decision. Ostrander Freight is the whole thing run end to end.

the starting point

The agent you already have

Concretely, the thing most Google shops mean when they say agent:

a typical google agent · before the mesh knows it exists
  • Built with ADK or plain code reasoning on Gemini through Vertex AI
  • Speaking A2A over HTTPS with an agent card at a well-known URL; ADK serves both for free
  • Running on Cloud Run or GKE as a service account, with IAM deciding what its tools may touch
  • Using your tools and data internal APIs, BigQuery, whatever the job needs
  • Watched in Cloud Trace and Cloud Logging like every other service you run
  • Secrets in Secret Manager rotated on your existing runbook

the touch points

Where the mesh touches it

The mesh touches this agent in a small number of places, each one a decision with its own page in the menu. Everything else, the model, the prompts, IAM, the tools, where it runs, stays exactly as Google built it.

its agent card Read once over HTTPS, when the gateway starts standing in front of the agent. The agent itself changes not at all, and this is where most shops start. decision 02
its code Touched only when the agent must start work rather than answer it: one SDK library, one outbound WebSocket held by the agent's own process. decision 02
its runtime Unchanged while the gateway is fronting it. Holding a mesh connection means staying resident: pinned on Cloud Run, one replica on GKE. decision 03
its network One outbound flow on 443. Nothing listens, no inbound rule, no public IP. decision 04
its secrets One mesh credential beside the ones already there, born from a single-use key and renewing itself. decision 05
its traces The hop between companies lands in the Cloud Trace you already open, as ordinary OTLP spans. decision 06
its inbox Mail from other companies' agents goes past your own Model Armor template before the agent sees it. decision 07
all of the above Points at the public instance by default, or at a mesh you run yourself. decision 01

To see the whole thing as one story with every command, Ostrander Freight takes its rate agent from attached to full node to traced, end to end.