The Pentagon Is Betting on Agents Before They're Safe. Google Is Selling the Insurance.

Reflection AI hasn’t shipped a widely available model. The Pentagon just put it on the shortlist for classified AI operations alongside Microsoft, Amazon, and Nvidia.

The US government doesn’t wait for governance standards to mature. It writes checks. Right now it’s buying pure agentic potential, betting the safety cages will catch up later. The expanded defense supplier roster is the most honest signal of where the industry actually is: demand for agent capabilities is far outstripping the infrastructure to control them.

Google is the first major platform provider to productize the answer.

Google’s Product Is the Cage

At Google Cloud Next ‘26, the company unveiled the Gemini Enterprise Agent Platform. The marketing talks about autonomy. The architecture talks about constraints.

The platform gives every agent a built-in state machine. Logging. Approval thresholds. Policy-as-code. Google is formalizing what every builder eventually learns the hard way: an agent without a kill switch isn’t a product, it’s a liability.

We have been treating agents like glorified scripts. Google wants us to treat them like microservices: strict contracts, clear boundaries, deploy-time validation. The platform replaces the ad-hoc safety checks we all duct-tape together with a native, enterprise-grade control plane. It’s the difference between a demo and a deployment.

Remy Walks the Beat

Remy, Google’s staff-only personal agent inside Gemini, is the test run for this philosophy.

Remy acts. It books, edits, and sends on behalf of the user. The engineering challenge isn’t the reasoning. It’s the authorization. How does Remy get permission to act? What stops it from flooding your inbox? Remy exists to validate the governance layer before Google sells it to your CTO.

The agent and its leash are shipping together. That’s the model for the next five years.

Physical AI Demands Harder Rules

This works well when the agent lives entirely in software. The governance of Physical AI introduces a different class of problem.

A software agent that hallucinates a bad API call is a bug you roll back. A physical agent that misreads a sensor is a safety incident. The kill switch for a robot arm isn’t a flag in a dashboard. It’s a hardware relay that cuts main power.

Google’s platform doesn’t solve the physical world. Not yet. But it draws a clear line in the sand: the industry is bifurcating into software agents with guardrails and physical agents with cages. The gap between the two is the biggest unaddressed risk in the industry.

The Signal

Builders who treat safety as a post-launch problem are about to hit a wall.

The market is sorting into two groups. Teams that can prove their agents are controllable, and teams that can’t. The first group will win the high-leverage contracts—enterprise, defense, healthcare. The second group will keep shipping prototypes into a vacuum.

The Department of Defense, major banks, and healthcare providers won’t deploy an agent they can’t audit or shut down. If your agent framework doesn’t include a robust governance layer, you aren’t pushing the envelope. You are designing for a demo that will never close.

The Pentagon is buying the future of agentic AI right now. Google is selling the infrastructure to run it safely.

Ship the agent. Ship the kill switch. Intelligence is table stakes. Control is the new moat.