Rush Hour: Gemini Enterprise Agent Platform workshop

Module 5

ENGAGE

Publish your agent to Gemini Enterprise — the pro-code thing you vibe-built
is now a chat anyone in the organization can use.

Gemini Enterprise agents-cli deploy agents-cli publish

The Payoff

Two hours ago, the Agent Platform console was empty and Gemini Enterprise had no agents. Now you'll publish the agent you built, scaled, governed, and optimized — and talk to it as a non-technical ops manager would. This is the "after" picture.

Engage in 2 Steps

4 min

Publish to Gemini Enterprise

This is the payoff. One prompt takes the agent you built in M1 and deployed in M2 and attaches it to your Gemini Enterprise app — no redeploy needed (M2 already shipped it with agent identity and Gemini Enterprise compatibility) — so anyone in the organization can chat with it, no IDE, no code, no API calls.

Paste into AGY Module 5 Step 1: publish to Gemini Enterprise. First, use the google-developer-knowledge MCP to read up on creating a Gemini Enterprise app AND publishing agents to it, so you use the current flow/API. Publish the agent I already deployed to Agent Runtime in M2 to business users — do NOT redeploy and do NOT change its logic. It was deployed with agent identity and its runtime wrapper already normalizes the session_id Gemini Enterprise sends, so it's ready to publish as-is. 1) List the available Gemini Enterprise apps, then make sure an app with id transit-crisis exists — if it doesn't, create it. (A fresh project — e.g. plain Cloud Shell — ships no Gemini Enterprise app; only some lab environments pre-provision one.) Look up the current create-app method via the google-developer-knowledge MCP, then create the Gemini Enterprise app transit-crisis in location global and wait until it's ready before continuing. For all Gemini Enterprise calls use the regional endpoint https://global-discoveryengine.googleapis.com/v1alpha/… (the plain discoveryengine.googleapis.com host can return an empty list / 401 for these resources), and pass -H "X-Goog-User-Project: PROJECT_ID" on every call (the ambient ADC on Cloud Shell has no quota project, so the call 403s without it). 2) Register the existing deployed agent (from deployment_metadata.json) to that app, with the display name "Transit-Crisis Agent" (so it's easy to find in the portal's Agents list). 3) Confirm the registration from the CLI (headless check — don't rely on the browser). Run: agents-cli publish gemini-enterprise --list and show that our agent now appears registered to the app (or, if that doesn't list it, do a discoveryengine GET on the registered agent resource name and show it exists — add -H "X-Goog-User-Project: PROJECT_ID" to that curl, or it returns 403 on Cloud Shell where the ambient ADC has no quota project). 4) Create a file named registration_results.md in the project root (write it with your file tools — this is a required deliverable, do NOT just print it). It must contain: the registered agent resource name, the app it was registered to, the Agent Engine console link, and the Gemini Enterprise console link. After writing it, cat the file back to confirm it exists.

What M2 set up for this moment

Remember the runtime wrapper you dropped in at M2 Step 1 — we said we'd revisit it here. This is why it was required. You're publishing the existing M2 deployment — no new Reasoning Engine revision — and two things that wrapper (plus the M2 deploy flags) enabled are what make the portal work now:

Session-id compatibility — Gemini Enterprise (AgentSpace) calls the runtime's streaming_agent_run_with_events and passes session_id as a full resource path (projects/…/sessions/<id>); ADK's session service rejects an id containing /. The wrapper you patched in M2 normalizes it to the bare id, so live portal chats don't fail with REMOTE_AGENT_FAILURE.
Agent identity — deploying with --agent-identity in M2 gave the agent a per-user identity, so personalization (home-station recall via Memory Bank) is scoped to each business user in the portal, not shared across everyone.

Expected Result

AGY runs agents-cli publish gemini-enterprise — discovering your Gemini Enterprise app with --list and registering the existing M2 deployment (no redeploy). It writes registration_results.md with:

The agent you built in M1 and deployed in M2 — already agent-identity enabled and GE session_id-compatible — registered into your Gemini Enterprise app ("My Gemini Google Search App")
Links to the Agent Engine console and the Gemini Enterprise console

What just happened: the agent you built, scaled, and governed is now registered in Gemini Enterprise — ready for business users. You'll test it in Step 2.

If a portal chat fails

If a Gemini Enterprise chat returns REMOTE_AGENT_FAILURE or "stream closed cleanly," the deployed wrapper is probably missing the M2 session_id normalization (GE sends a full resource path and ADK rejects an id containing /). Ask AGY to add the _normalize_session_id override to app/agent_runtime_app.py (see M2 Step 1) and redeploy once — then retry the chat.

3 min Why It Matters

The Unified Finish Line

Open both console pages and compare to the empty screens you saw in M0:

Open these two pages now

Agent Engine Console — your deployed agent with endpoint, health status, and Playground
Gemini Enterprise Console — your published agent, ready for business users to chat with

In M0, these were empty. Now they show a production agent with identity, governance, and memory.

Select your agent first

Open "My Gemini Google Search App" in Gemini Enterprise, click "Agents" in the left navigation, then select "Transit-Crisis Agent". If you see two entries, pick the most recent one. The default chat uses Google Search, not your agent.

Now test it as a business user:

gemini enterprise"Trains out of St Pancras are disrupted — what do I tell travelers heading to Paris?"

Recap the full journey — Build → Scale → Govern → Optimize → Engage — and the artifacts now living in the platform:

Phase	What you did	Platform artifact
M1 · Build	Vibe-built agent + 3 tools by prompting	ADK project, reasoning trace
M2 · Scale	Deployed to cloud with state management	Agent Runtime, Sessions, Memory Bank, Sandbox
M3 · Govern	Verified registry + identity, attack-shielded with Model Armor	Agent Registry, SPIFFE Identity, Model Armor
M4 · Optimize	Local eval loop: graded eval with an LLM judge, flagged ungrounded sentences	Eval scores, judge-flagged sentences
M5 · Engage	Published for business users	Gemini Enterprise agent

The Unified-Stack Message

Business users can now consume what platform builders produced. The same platform spans both audiences — from ADK code to Gemini chat.

Final Checkpoint — Workshop Complete When:

The agent deployed in M2 is published to Gemini Enterprise
You can chat with it as a non-technical user in the Gemini Enterprise portal (no REMOTE_AGENT_FAILURE)
The agent answers the crisis question with a concrete reroute
Compare the "before" (empty console) to the "after" (full platform)

The Full Build → Scale → Govern → Optimize → Engage Arc

Here's everything you built in 2 hours, from empty console to a governed, optimized, published agent:

Artifacts by Module

M0 · Setup

Cockpit ready, data downloaded, "before" screenshot captured

Antigravity + agents-cli + GTFS data + empty console

M1 · Build

Multi-tool transit agent running locally in ADK playground

ADK project · 3 tools · system instruction · reasoning trace

M2 · Scale

Deployed to Agent Runtime with stateful, personalized, sandboxed compute

Runtime instance · Sessions · Memory Bank · Code Execution sandbox

M3 · Govern

Verified as a registered, identity-bound, attack-shielded corporate asset

Agent Registry · SPIFFE Identity · Model Armor template

M4 · Optimize

Measured agent quality locally with a graded eval

Graded eval (adk eval) · hallucinations_v1 judge · flagged ungrounded sentences

M5 · Engage

Published the M2 deployment to Gemini Enterprise — anyone can chat with your agent

Gemini Enterprise agent · agent identity · GE-compatible sessions

The Thesis — Confirmed

You traversed the entire Build → Scale → Govern → Optimize → Engage lifecycle almost entirely by prompting inside Antigravity — and at every stage you left the IDE to see the real enterprise artifact the platform created for you.