Antigravity Enterprise Gateway: A Secure Pilot Checklist

Google made Antigravity Enterprise Gateway generally available on October 20, 2026. It lets an organization route model inference from the Antigravity app, CLI and supported IDE extensions through a gateway it operates before the traffic reaches Google Cloud.

The new route gives security and platform teams a central point to inspect model traffic, apply egress policy and preserve enterprise billing attribution. It also removes interactive Google sign-in from supported developer clients. These benefits depend on the gateway configuration. A shared API key or a proxy log does not, by itself, establish which developer made a request or whether the request followed an approved policy.

For a first rollout, treat the gateway as a security boundary that needs acceptance tests. The goal is to prove routing, identity, attribution and failure behaviour on managed workstations before expanding access.

What the gateway changes

Without gateway mode, a developer's Antigravity client connects to Google and uses an individual Google identity. With gateway mode, the workstation connects to an endpoint operated by the organization. The client presents an API key issued by that gateway. The gateway then authenticates to Gemini Enterprise Agent Platform through a centralized Google Cloud service account.

This creates two authentication steps:

1. The organization authenticates the developer client at its gateway.
2. The gateway authenticates to Google Cloud as a service account.

Google's October 20 release note says the gateway supports traffic inspection, auditing, custom security controls and network egress policy while retaining billing and quota attribution under the organization's Gemini Enterprise agreement.

The feature covers the Antigravity app, Antigravity CLI and Antigravity for supported IDEs. Antigravity on the web does not support enterprise gateway routing and still requires interactive Google sign-in. That difference should appear in the pilot scope so users do not assume every Antigravity surface follows the same network path.

Do not confuse routing with data residency

The gateway is an inspection and policy point. It still forwards inference requests to Google Cloud. It does not turn the model service into an on-premises deployment or prove that request processing stays in the gateway's region.

Regional processing, storage and contract requirements need a separate review against the Gemini Enterprise edition and endpoints the organization uses. Record those requirements in the architecture decision before enabling clients. A network diagram that stops at the gateway hides the most important outbound leg.

The same distinction applies to content controls. A proxy can log or block a request, but the policy must define which payload fields may be recorded, how long logs remain available and who can read them. Developer prompts may contain source code, configuration or credentials. Full-body logging can create a second sensitive-data store unless the team deliberately redacts and limits it.

Establish developer identity at the gateway

Antigravity sends the gateway API key as a bearer token in the Authorization header. Google warns that this key is stored as plain text in the administrator settings file or an environment variable on the workstation. The deployment guide recommends private network access, managed devices and regular key rotation.

A single key distributed to every developer proves only that the request came from someone with the shared secret. It cannot provide reliable per-person attribution. Google recommends separate keys for individual developers when teams need that level of usage tracking.

For a stronger identity boundary, combine the key with a control the user cannot edit, such as mutual TLS, proxy-level single sign-on, device posture checks or network microsegmentation. Google also warns against trusting client-supplied custom headers for security-critical audit or billing decisions. A developer who controls the workstation may be able to alter them.

Your first acceptance test should therefore compare three requests: one from a managed and authorized workstation, one with an invalid key, and one from outside the approved network. The gateway should accept only the first request and should record the reason for each denial without capturing unnecessary prompt content.

Preserve attribution headers deliberately

Antigravity attaches User-Agent and X-Goog-Api-Client headers so Google can attribute activity to the licensed enterprise deployment. The gateway must pass those headers through unchanged. If it forwards requests to a project other than the project containing its service account, it also needs to inject X-Goog-User-Project with the target project ID for billing and quota attribution.

Custom headers can add an internal cost center or business-unit label. Deploy them in the administrator settings file through mobile device management when users should not be able to override them. The administrator file has higher precedence than environment variables and the user's local settings.

Verify attribution with Data Access audit logs for Gemini Enterprise Agent Platform. Send known requests from two test groups, then check whether the expected project, licensed usage and internal labels appear in Cloud Logging and the gateway's own records. A successful model response does not prove the accounting path is correct.

Keep streaming responsive

Coding agents often stream long responses. Google requires the gateway to flush Server-Sent Events immediately instead of buffering them. It must route both the short generateContent paths and their full project and region forms. Google also advises allowing requests to run for at least 60 minutes so long streaming responses are not cut off.

Buffering can make a healthy model appear stalled. A timeout that works for a short chat may still break an autonomous refactor or repository analysis. Test a long response and measure three timings:

• time from the client request to the first streamed chunk
• gaps between chunks while the response is active
• the point at which the gateway, load balancer or upstream service closes the connection

The test should run through every production hop, including the corporate network, load balancer and gateway runtime. A direct request to the container does not exercise those intermediary limits.

The gateway must also handle Antigravity's background metric calls. Google's deployment guide says it can return 200 OK with an empty object or forward the calls to a security information and event management system. Decide which approach the organization needs and test it explicitly. Silently dropping those calls can create confusing client failures or incomplete telemetry.

Choose the wire protocol with client compatibility in mind

Antigravity Enterprise Gateway supports Google's generateContent protocol and the OpenAI Chat Completions wire protocol. The second option may help organizations use an existing compatible gateway layer. It is not universal across all supported clients.

JetBrains IDEs and Zed use the Antigravity ACP server, which supports only the Google protocol. Configuring the administrator settings with the OpenAI wire protocol causes those sessions to fail. A protocol decision therefore belongs in the client compatibility matrix, alongside operating systems and minimum versions.

Google's current minimums are Antigravity app 2.15.0, Antigravity CLI 1.2.15, and ACP server 1.3.0 for JetBrains IDEs and Zed. Visual Studio Code and Visual Studio extensions rely on Antigravity CLI 1.2.15 or later. Confirm the installed versions on managed devices before interpreting a connection failure as a gateway policy problem.

Avoid an authentication collision on Cloud Run

Organizations can host the gateway on Cloud Run, Envoy, LiteLLM, Apigee or another containerized or managed platform. The hosting choice does not remove the need to reconcile authentication headers.

Google cautions against putting the gateway behind Cloud Run IAM invoker checks or Identity-Aware Proxy when those layers read the Authorization header. They expect a Google-signed identity token and can reject the gateway-issued API key before the application sees it.

If the platform team uses Cloud Run, document how network access and client authentication reach the gateway without that header collision. Then send invalid, expired and missing credentials through the actual front door. Confirm that the response does not reveal internal routing details and that the failure appears in the correct audit system.

Apply workstation policy through managed settings

The administrator settings file can define the gateway URL, wire protocol, custom headers, corporate certificate authority and approved model list. Google documents standard locations for macOS, Linux and Windows and recommends deployment through an MDM system such as Jamf, Microsoft Intune, Ansible or Google Workspace MDM.

The file must be writable only by administrators. Otherwise, a developer could replace the gateway endpoint, remove an attribution header or select an unapproved model. Restart behaviour also matters because Antigravity reads the settings when it starts.

Test a managed device for the following:

• the user cannot modify the administrator file or its directory
• a user setting cannot override the gateway URL, approved models or pinned headers
• the corporate certificate validates the private gateway without a bypass
• the client fails closed when the gateway is unreachable
• a configuration update becomes active after the documented restart

These controls complement the runtime boundary described in our guide to securing AI agents with external policy enforcement. The gateway governs model traffic. File, terminal, browser and repository permissions still need their own controls.

A focused pilot plan

Start with one engineering group, managed workstations and a non-production codebase. Keep the allowed model list short and issue separate gateway credentials for the pilot participants.

1. Draw the complete request path from workstation to gateway to Google Cloud, including DNS, TLS termination and outbound egress.
2. Define which prompts, response fields and metadata may be logged, with retention and access rules.
3. Configure the gateway service account with roles/aiplatform.user in the intended project and enable Data Access audit logs.
4. Preserve Google's attribution headers and pin any security-sensitive custom headers through managed settings.
5. Restrict the endpoint to approved networks and devices, then add per-developer authentication where individual attribution is required.
6. Test unary and streaming requests, telemetry calls, timeouts and model allowlisting across every supported client.
7. Reconcile gateway logs, Google Cloud audit records, quota usage and billing attribution for known test requests.
8. Exercise key rotation, gateway outage and configuration rollback before adding more users.

The rollout decision should depend on evidence from these tests. Platform owners should be able to identify who sent a request, which policy allowed it, where it was forwarded, how it was attributed and what happened when a dependency failed.

Bayseian helps teams design and evaluate Gemini Enterprise deployments with practical identity, network and evidence boundaries. A narrow gateway pilot can expose gaps in those controls before coding agents reach sensitive repositories.

Sources

• Google Cloud, Gemini Enterprise release notes, October 20, 2026.
• Google Cloud, Deploy Google Antigravity Enterprise Gateway, accessed October 21, 2026.
• Google Cloud, Connect Antigravity to an Enterprise Gateway, accessed October 21, 2026.
• Google Cloud, AI developer tools overview, accessed October 21, 2026.