About This Edition: A clean, intermediate-level architectural guide covering all 5 Domain Sections, 11 Subsections (
1.1–5.2), and 31 Considerations of the Google Cloud Professional Agentic Architect curriculum, illustrated with Mermaid architecture blueprints and 62 custom-designed concept & architecture diagrams.
Chapter Plan at a Glance
Ch # | Chapter Title | Subsections | Considerations | Custom Diagrams | Core Focus |
|---|---|---|---|---|---|
00 | Overview | — | Mermaid | The 6 Architectural Layers, plain-English guide to all 28 tools, and the 10 Core Principles. | |
01 | 1.1, 1.2 | 4 | 8 | Building state-machine agents in CX Agent Studio, steering behavior with structured console prompts, connecting enterprise data securely with Agent Search, and ingesting video, audio, and visual documents. | |
02 | 2.1, 2.2 | 5 | 10 | Connecting coding agents to internal tools via MCP, isolating untrusted code execution in GKE Sandbox and Cloud Workstations, and customizing Antigravity with Skills, Rules, Hooks, Subagents, and Agents CLI. | |
03 | 3.1 | 4 | 8 | Selecting the right model (Gemini Pro vs. Flash vs. open-weight SLMs), building code-first agents with ADK, managing short-term Sessions vs. long-term Memory Bank, and configuring CLI skills in Agent vs. Human mode. | |
04 | 3.2 | 3 | 6 | Designing high-precision RAG pipelines (chunking, asymmetric embeddings, hybrid search, cross-encoder reranking), configuring Agent Identity permissions, and connecting databases/SaaS via MCP servers and Agent Registry. | |
05 | 3.3 | 2 | 4 | Distinguishing MCP (agent-to-tool) from A2A (agent-to-agent), Agent Cards, asynchronous long-running task lifecycles, and coordinating Sequential, Parallel, Router, and Cyclic Graph multi-agent handoffs. | |
06 | 4.1, 4.2 | 7 | 14 | Testing agents with golden datasets, trajectory metrics, and LLM-as-a-Judge autoraters; choosing between Agent Runtime, Cloud Run, and GKE; and troubleshooting latency, loops, and costs with Cloud Trace and caching. | |
07 | 5.1, 5.2 | 6 | 12 | Securing agent-to-tool auth with OAuth 2.0 and WIF, bounding permissions with Principal Access Boundary (PAB), monitoring traffic at the Agent Gateway, blocking prompt injections with Model Armor, and enforcing HITL gates and DLP redaction. | |
08 | All Sections | — | — | Side-by-side Look-Alike Tool Comparison Matrix, 5-Step Architecture Decision Checklist, and Top 25 Golden Rules. |
Detailed Table of Contents
Chapter 0: The PAA Reference Stack & 10 Core Principles
- 0.1 The Master Map: All 28 Tools in the PAA Stack (Plain-English Guide)
- 0.2 The 10 Core Architectural Principles
Chapter 1: Low-Code Agentic Workflows, Prompting & Multimodal Data Stores
- Subsection 1.1: Configuring Agentic Workflows and Behavior Using Low-Code Tools (Section 1: Building Agents Using Low-Code Tools)
- Consideration 1.1a: Configuring State-Based Workflows (Pages, Transition Routes, and Event Handlers) (Diagrams:
paa-1.1a-1-cx-page-lifecycle.jpg,paa-1.1a-2-event-handler-scoping.jpg) - Consideration 1.1b: Creating System Instructions and In-Console Prompt Templates (Few-Shot & Chain-of-Thought) (Diagrams:
paa-1.1b-1-prompt-template-layers.jpg,paa-1.1b-2-session-var-injection.jpg) - Quick Decision Cheat Sheet (Subsection 1.1)
- Subsection 1.2: Connecting Enterprise Data to Gemini Enterprise (Section 1: Building Agents Using Low-Code Tools)
- Consideration 1.2a: Configuring Agents to Securely Connect and Query Enterprise Proprietary Data Sources (Diagrams:
paa-1.2a-1-agent-search-acl.jpg,paa-1.2a-2-vpc-sc-cmek-datastore.jpg) - Consideration 1.2b: Ingesting and Processing Unstructured Multimodal Data (Videos, Audio, and Images) (Diagrams:
paa-1.2b-1-multimodal-ingestion.jpg,paa-1.2b-2-live-vs-indexed-media.jpg) - Quick Decision Cheat Sheet (Subsection 1.2)
Chapter 2: Enterprise Coding Agents, Secure Sandboxes & Antigravity Customization
- Subsection 2.1: Using Coding Agents Effectively (Section 2: Using Coding Agents for Application Development)
- Consideration 2.1a: Configuring Coding Agents with MCP Servers, Custom Skills, and Access to Tools (Diagrams:
paa-2.1a-1-coding-agent-mcp.jpg,paa-2.1a-2-mcp-output-truncation.jpg) - Consideration 2.1b: Using Coding Agents in Secure Sandboxes (GKE, Cloud Workstations, and Antigravity) (Diagrams:
paa-2.1b-1-gke-sandbox-gvisor.jpg,paa-2.1b-2-cloud-workstations-vpcsc.jpg) - Consideration 2.1c: Using Coding Agents to Refactor Source Code, Optimize Runtimes, and Patch Vulnerabilities (Diagrams:
paa-2.1c-1-tdd-refactoring-loop.jpg,paa-2.1c-2-ast-vulnerability-patch.jpg) - Quick Decision Cheat Sheet (Subsection 2.1)
- Subsection 2.2: Customizing Coding Agents for Enterprise Workflows (Section 2: Using Coding Agents for Application Development)
- Consideration 2.2a: Creating Skills, Plugins, Extension Hooks, Rules, and Subagents Using Antigravity (Diagrams:
paa-2.2a-1-rules-skills-hooks.jpg,paa-2.2a-2-subagent-delegation.jpg) - Consideration 2.2b: Augmenting Antigravity with Agents CLI to Build, Scale, Govern, and Optimize Deployed Agents (Diagrams:
paa-2.2b-1-agents-cli-cicd.jpg,paa-2.2b-2-agents-cli-profiling.jpg) - Quick Decision Cheat Sheet (Subsection 2.2)
Chapter 3: Custom Agentic Workflows in Code: Models, ADK, Sessions & Memory Bank
- Subsection 3.1: Designing and Building Agentic Workflows in Code (Section 3: Developing Custom Agents)
- Consideration 3.1a: Selecting and Configuring the Appropriate Language Model (LLM vs. SLM, SaaS vs. Self-Hosted, Proprietary vs. OSS) (Diagrams:
paa-3.1a-1-tiered-model-routing.jpg,paa-3.1a-2-saas-vs-self-hosted.jpg) - Consideration 3.1b: Building Custom Agents Using Open-Source Libraries (Agent Development Kit [ADK]) (Diagrams:
paa-3.1b-1-adk-workflow-agents.jpg,paa-3.1b-2-adk-hitl-checkpoint.jpg) - Consideration 3.1c: Configuring Sessions and Memory (Agent Platform Memory Bank and Managed Sessions) (Diagrams:
paa-3.1c-1-sessions-vs-memory-bank.jpg,paa-3.1c-2-async-memory-distillation.jpg) - Consideration 3.1d: Configuring Skills Using Agents CLI (Plugins and Agent vs. Human Mode) (Diagrams:
paa-3.1d-1-agent-vs-human-mode.jpg,paa-3.1d-2-plugin-namespaces-mocking.jpg) - Quick Decision Cheat Sheet (Subsection 3.1)
Chapter 4: Enterprise Domain Knowledge: RAG Pipelines, Vector Search, Identity & MCP Tooling
- Subsection 3.2: Integrating Enterprise Domain Knowledge (Section 3: Developing Custom Agents)
- Consideration 3.2a: Designing, Configuring, and Managing RAG Pipelines and Vector Retrieval Systems (Diagrams:
paa-3.2a-1-hybrid-rag-reranking.jpg,paa-3.2a-2-asymmetric-embeddings.jpg) - Consideration 3.2b: Configuring Agent Permissions (Agent Identity) (Diagrams:
paa-3.2b-1-agent-vs-user-identity.jpg,paa-3.2b-2-least-privilege-roles.jpg) - Consideration 3.2c: Using Google Cloud Tools (Agent Registry, Google Cloud MCP Servers) to Configure Prebuilt and Custom Capabilities (Diagrams:
paa-3.2c-1-cloud-sql-mcp-server.jpg,paa-3.2c-2-agent-registry-mcp.jpg) - Quick Decision Cheat Sheet (Subsection 3.2)
Chapter 5: Multi-Agent Topologies & Agentic Protocols (MCP vs. A2A)
- Subsection 3.3: Orchestrating and Coordinating Agentic Workflows (Section 3: Developing Custom Agents)
- Consideration 3.3a: Orchestrating Agents Using Agentic Protocols (MCP and Agent2Agent [A2A]) (Diagrams:
paa-3.3a-1-mcp-vs-a2a-protocols.jpg,paa-3.3a-2-a2a-async-lifecycle.jpg) - Consideration 3.3b: Selecting and Coordinating Multi-Agent Handoffs and Workflows (Parallel, Sequential, and Graph Workflows) (Diagrams:
paa-3.3b-1-multiagent-topologies.jpg,paa-3.3b-2-handoff-claim-check.jpg) - Quick Decision Cheat Sheet (Subsection 3.3)
Chapter 6: AgentOps: Evaluation, Autoraters, Deployment, Tracing & Cost Optimization
- Subsection 4.1: Evaluating and Testing Agents in Development and Production (Section 4: Testing, Deploying, Monitoring, and Scaling Production Agents)
- Consideration 4.1a: Creating Test Sets for Agent Evaluation (Golden Data, Prompts, and Edge Cases) (Diagrams:
paa-4.1a-1-golden-dataset-anatomy.jpg,paa-4.1a-2-golden-data-flywheel.jpg) - Consideration 4.1b: Creating Continuous Evaluation Pipelines to Assess Tool Execution (Diagrams:
paa-4.1b-1-syntactic-vs-semantic.jpg,paa-4.1b-2-cicd-eval-gate.jpg) - Consideration 4.1c: Determining the Appropriate Evaluation Framework and Tooling (ADK Evalset, Gen AI Evaluation Service, and Custom Autoraters) (Diagrams:
paa-4.1c-1-adk-vs-genai-eval.jpg,paa-4.1c-2-custom-autoraters.jpg) - Consideration 4.1d: Evaluating an Agentic System Against a Golden Dataset for Response and Retrieval Quality (Diagrams:
paa-4.1d-1-rag-triad-metrics.jpg,paa-4.1d-2-trajectory-match-modes.jpg) - Quick Decision Cheat Sheet (Subsection 4.1)
- Subsection 4.2: Deploying, Monitoring, and Troubleshooting Production Workloads (Section 4: Testing, Deploying, Monitoring, and Scaling Production Agents)
- Consideration 4.2a: Selecting the Optimal Deployment Runtime (Agent Runtime, Cloud Run, and GKE) (Diagrams:
paa-4.2a-1-runtime-decision-tree.jpg,paa-4.2a-2-cloud-run-service-vs-job.jpg) - Consideration 4.2b: Troubleshooting Agent Issues (Drift, Tool Latency, Reasoning Loops, and System Failures) (Diagrams:
paa-4.2b-1-breaking-agent-loops.jpg,paa-4.2b-2-circuit-breaker-fallback.jpg) - Consideration 4.2c: Monitoring and Optimizing Agents for Performance, Reliability, and Cost (Diagrams:
paa-4.2c-1-cloud-trace-waterfall.jpg,paa-4.2c-2-context-vs-semantic-cache.jpg) - Quick Decision Cheat Sheet (Subsection 4.2)
Chapter 7: Securing & Governing Agentic Systems: OAuth 2.0, PAB, Model Armor, Guardrails & HITL
- Subsection 5.1: Configuring Agent Security and Governance (Section 5: Securing and Governing Agentic Systems)
- Consideration 5.1a: Implementing Authentication and Secure Tool Execution (OAuth 2.0, OIDC, and Workload Identity Federation) (Diagrams:
paa-5.1a-1-oauth-oidc-wif-flows.jpg,paa-5.1a-2-cloud-run-oidc-auth.jpg) - Consideration 5.1b: Configuring Principal Access Boundary (PAB) Policies Using Agent Identity (Diagrams:
paa-5.1b-1-pab-iam-intersection.jpg,paa-5.1b-2-pab-exfiltration-block.jpg) - Consideration 5.1c: Configuring Agent Gateway to Monitor Traffic and Track Agents (Diagrams:
paa-5.1c-1-agent-gateway-proxy.jpg,paa-5.1c-2-gateway-rate-limiting.jpg) - Consideration 5.1d: Designing and Configuring Agentic Governance and Policy Enforcement (Agent Registry and Model Armor) (Diagrams:
paa-5.1d-1-model-armor-pipeline.jpg,paa-5.1d-2-governance-stack.jpg) - Quick Decision Cheat Sheet (Subsection 5.1)
- Subsection 5.2: Implementing Secure Agent Behavior and Execution (Section 5: Securing and Governing Agentic Systems)
- Consideration 5.2a: Designing Appropriate Safety Frameworks and Guardrails (Agent Gateway, Model Armor, and Human-in-the-Loop [HITL]) (Diagrams:
paa-5.2a-1-hitl-safety-guardrails.jpg,paa-5.2a-2-ast-iam-sql-guardrail.jpg) - Consideration 5.2b: Configuring Secure Access to Data and Identity Propagation (Agent Gateway and Agent Registry) (Diagrams:
paa-5.2b-1-identity-propagation.jpg,paa-5.2b-2-gateway-dlp-registry.jpg) - Quick Decision Cheat Sheet (Subsection 5.2)
Chapter 8: Master Look-Alike Tool Comparison & Decision Playbook
- 8.1 The Master Look-Alike Tool Comparison Matrix
- 8.2 The 5-Step Architecture Decision Checklist
- 8.3 Top 25 Golden Rules for Final Review
Generating the Custom Illustrations (paa-image-prompts.json)
All 62 custom image prompts and output filenames for this book are stored in paa-image-prompts.json (and mirrored in openai-image-gen/out/9001-openai-prompts-paa-book.json). To generate the illustrations using openai-image-gen/images-from-prompts.py, run:
cd openai-image-gen uv run images-from-prompts.py -file ../books/paa-architecture-takeaways/paa-image-prompts.json -simple -quality medium
AwesomeGCP.com Learning
The approach taken is a question-led learning approach: you explore realistic project scenarios where you need to make decisions or take actions to achieve business goals within specific constraints. Instead of passive learning, you are challenged to think and work through the options to master the Professional Agentic Architect (PAA) certification!