google-adk

google-adk-governed-agent

Requirement	Version
Agent Assembly Python SDK (agent-assembly)	>= 0.0.1rc6

Install:

uv add agent-assembly==0.0.1rc6
# or
pip install agent-assembly==0.0.1rc6

Demonstrates how to integrate Agent Assembly with Google ADK (Agent Development Kit) to enforce governance policy on tool calls before execution.

What this example demonstrates

• Initializing Agent Assembly with init_assembly() in offline sdk-only mode.
• Installing Google ADK tool-level governance hooks (GoogleADKAdapter patches google.adk.tools.BaseTool.run_async).
• Running an allowed tool call (get_weather), a denied tool call (delete_records), and a pending tool call (send_email — requires approval, auto-denied offline).
• How PolicyViolationError is raised when a tool is blocked or rejected during approval.

Why this example replays a scripted trajectory (offline note)

Google ADK drives its agent loop against a cloud LLM (Gemini / Vertex AI), which requires credentials and a live network call. To keep the example runnable in CI with no secrets, it does not start a live model. Instead it replays a scripted tool trajectory: it builds real ADK BaseTool instances and invokes run_async directly — the exact surface the Agent Assembly governance adapter patches. The genuine allow / deny / pending governance code runs; only the LLM that would choose the tools is mocked out.

Adapter / version note

In ADK 1.x, concrete tools (FunctionTool and custom BaseTool subclasses) override run_async, so patching the BaseTool base class alone does not intercept them. The public GoogleADKAdapter handles this: register_hooks() patches BaseTool and every concrete tool class exported from google.adk.tools that overrides run_async, and init_assembly()'s auto-detection wires it for you against real ADK tools. This example uses that same public adapter (see src/governance.py); because its demo tool is a local BaseTool subclass rather than a real google.adk.tools tool, it registers the class into the adapter's public discovery scope before applying the hooks. A production agent exposing real ADK tools needs no such bridging.

Prerequisites

Requirement	Version
Python	>= 3.12
uv	latest
Agent Assembly Python SDK	>= 0.0.1rc6

No running Agent Assembly gateway and no Google Cloud credentials are required for the offline demo.

Setup

cd python/google-adk
uv sync --extra dev

Run

uv run python src/main.py

Expected output

==============================================================
  Agent Assembly — Google ADK Governed Agent Demo
==============================================================

Initializing Agent Assembly (gateway: http://localhost:8080, sdk-only mode)...
  Agent:    google-adk-demo-agent
  Gateway:  http://localhost:8080
  Mode:     sdk-only (offline demo)

Policy rules (local simulation of gateway policy):
  DENY    — delete_records, write_file  (destructive operations)
  PENDING — send_email                  (requires human approval)
  ALLOW   — everything else

Replaying scripted tool trajectory (no live LLM):
--------------------------------------------
  → get_weather(...)
     ✅ ALLOWED  — Weather: 22C, partly cloudy (mock response)

  → delete_records(...)
     ❌ BLOCKED  — Tool 'delete_records' blocked by governance policy: Tool 'delete_records' is blocked by policy rule 'deny_destructive_operations'.

  → send_email(...)
     ❌ BLOCKED  — Tool 'send_email' rejected during approval: Tool 'send_email' requires approval, but no approver is available in offline mode.

Assembly context shut down.

Run tests

uv run pytest tests/ -v

Switching to production mode

1. Start an Agent Assembly gateway or use your SaaS workspace URL.
2. Copy .env.example to .env and fill in your credentials.
3. Build a real google.adk.agents.Agent with your tools and run it via the ADK Runner, setting a Gemini / Vertex AI key to drive the live model.
4. Run with gateway environment variables:

AGENT_ASSEMBLY_GATEWAY_URL=http://localhost:8080 \
AGENT_ASSEMBLY_API_KEY=your-key \
uv run python src/main.py

In production, init_assembly() auto-detects Google ADK and registers the adapter automatically, and the gateway enforces the policy rules — replace LocalPolicyEngine with the gateway-backed interceptor.

Troubleshooting

Problem	Fix
ModuleNotFoundError: agent_assembly	Run uv sync first
ModuleNotFoundError: google.adk	Run uv sync — google-adk is a required dependency
PolicyViolationError in tests	Expected — the deny/pending policy rules are intentional

Links

• Agent Assembly Python SDK
• Agent Assembly Examples
• Python Examples