Gemini Managed Agents add token caps and tool-call hooks

Google shipped an update to Gemini API Managed Agents that is less exciting than a model launch and more useful than one. Three of the additions — a hard token budget, hooks that run before and after tool calls, and cron-scheduled triggers — are the exact controls that separate an agent you can put on a client's data from a demo you show at a meetup. If you're evaluating any agent runtime right now, this is the checklist to hold it to.

What actually happened

Per Google's announcement, Gemini 3.6 Flash is now the default model for the antigravity-preview-05-2026 agent, with alternatives selectable via agent_config.model. The parts that matter operationally:

Budget caps. Pass max_total_tokens inside agent_config and it caps input, output, and thinking tokens together. Hit the ceiling and the run pauses with status "incomplete" rather than dying — you resume with previous_interaction_id and a fresh budget. That is a spend ceiling with a resume button, which is a meaningfully different thing from a billing alert that fires after you've spent the money.

Tool-call hooks. A .agents/hooks.json file registers pre_tool_execution and post_tool_execution handlers, matched to tools by regex. A pre-hook can return {"decision": "deny", "reason": "..."} and the call doesn't happen. Handlers can be a shell command or an HTTP endpoint, with timeouts.

Scheduled triggers bind an agent, environment, prompt, and cron expression into a persistent resource. An Environments API lets you list, inspect, and delete sandbox sessions instead of waiting out the 7-day TTL. Managed agents also now run on free-tier projects.

Why agent governance matters for your business

Most agent failures we get called in to clean up aren't model failures. They're an agent that ran 400 times overnight on a loop nobody capped, or one that called a write endpoint because nothing sat between the model's intent and the API.

max_total_tokens and a deny-capable pre-hook fix both, and notice where they live: outside the model. The model proposes, the runtime enforces. Any agent platform that asks you to solve this with prompt instructions — "please don't delete records" — is handing you the liability.

You don't have to adopt Gemini to use this. Take the three requirements to whatever stack you're on: can I cap spend per run, can I intercept and deny a tool call, and can I schedule it without a laptop staying open? If the answer to any of those is no, you're not deploying an agent, you're deploying a hope.

Sources: Google Blog.