Google has added a control layer to the managed agents in its Gemini API, letting developers run their own code before and after every tool call an agent makes inside its cloud sandbox, and cancel the call outright. The same update makes Gemini 3.6 Flash the default model behind the agent, caps how many tokens a single run can consume, and opens the feature to projects with no billing attached.

Managed agents are Google’s hosted version of the agent loop, the same pattern behind the assistants now being wired to take actions rather than answer questions. One API call provisions a Linux sandbox, and the model then plans, executes code, installs packages, reads and writes files, and fetches web pages until the task is done. That architecture is what made the new feature necessary: the sandbox was a place developers could send work into but could not police from the inside.

Environment hooks change that. A hooks.json file mounted into the sandbox registers handlers against two moments in the loop, before a tool runs and after it finishes. Each rule matches tool names by regular expression, so one entry can cover code execution and file writes together or intercept every call. When a pre-execution handler returns a denial, the runtime skips the tool call and passes the stated reason back into the model’s context, where the agent can choose a different route or explain the block to the user inside the same turn.

What the hooks reach

Hooks fire on the tools Google runs inside the container: code execution, plus the filesystem operations that read, write, list and delete files. Custom functions the developer executes client-side and remote Model Context Protocol servers run outside the container, so hooks do not intercept those.

Failures resolve toward permission. If a hook script exits with an error, times out, returns a server error, or emits JSON the runtime does not recognize, the tool call goes ahead. Google’s documentation gives the reason: a broken linter or an unreachable telemetry server should never be able to deadlock a production application.

The second handler type posts the event straight to an external endpoint from inside the sandbox network, which is how audit logging works. Those requests travel through Google’s egress proxy, so the destination has to sit on the environment’s allowlist, and authentication tokens live in the network configuration rather than in the hook file, with the proxy injecting real headers on the wire. Google also notes that an agent holding shell or write access can edit a hooks file in a writable workspace, and points developers who need tamper resistance toward mounting that configuration from a read-only repository.

Policing what an agent is allowed to do is drawing venture money of its own. Google is putting the check inside its own runtime.

Verification pipelines are the first use it put a customer name to. Alston Lin, founder and chief technology officer of the AI-native investment bank OffDeal, said a post-execution hook now runs his firm’s image-checking pipeline the moment its analyst agent writes out a company list, enforcing pixel-level quality rules on the dozens of logos a banker-ready deck needs. “Before agent hooks, we couldn’t do this on Gemini’s managed agents: the sandbox is remote, so our validation code had nowhere to run,” he said.

Gemini 3.6 Flash takes over as the default

The managed agent runs Gemini 3.6 Flash without any code change, picking it up on the next interaction. Developers can pin a different model by passing it in the agent’s configuration, choosing Gemini 3.5 Flash for continuity or 3.5 Flash-Lite for lower cost and latency. For agents saved as persistent resources, the model is fixed at creation and cannot be overridden per call, which Google says keeps tool-calling behavior, debugging and security boundaries predictable.

Google released 3.6 Flash on July 21, 2026 alongside 3.5 Flash-Lite and a security-tuned 3.5 Flash Cyber, the launch in which its delayed 3.5 Pro flagship was pushed back again. It prices at $1.50 per million input tokens and $7.50 per million output tokens, against $9.00 output for 3.5 Flash, and the company reports it consumes 17% fewer output tokens on the Artificial Analysis Index while scoring 49% on the DeepSWE coding benchmark versus 37% for its predecessor. The cheaper token profile is the part that matters inside an agent loop, where one task can run for hundreds of steps.

Spend limits and scheduled runs

Cost is the other thing this release addresses directly. A token ceiling passed with the request caps input, output and thinking tokens across the whole interaction; cached tokens are excluded, and the limit is best-effort rather than exact. When an agent hits it, the run returns as incomplete with the sandbox state intact, and a follow-up call resumes the work with a fresh allowance. Google’s own estimates put a heavy data-processing task at $0.70 to $3.25, with complex workflows accumulating three to five million tokens and roughly $5 in a single interaction. Sandbox compute is not billed during the preview.

Two additions turn the agent into standing infrastructure rather than a per-request call:

  • Scheduled triggers bind an agent, a prompt, an environment and a cron expression into a persistent resource that fires on its own, pausing itself by default after five consecutive failures. Every run reuses the same sandbox, so files written by one execution are visible to the next.
  • An environments interface lists, inspects and deletes sandbox sessions from code, which recovers an environment ID after a dropped connection and clears sandboxes when a pipeline finishes instead of waiting out their seven-day expiry.

The features build on a July 7, 2026 release that gave managed agents background execution, remote Model Context Protocol connections, custom function calling and mid-session credential refresh. Together they put a scheduled, budget-capped agent with an enforceable policy layer within reach of a developer working from a free API key.