Google’s New Gemini Agent Platform Enables TokenCore Biometric Gates

Google’s Gemini at Work 2026 announcements make one thing increasingly clear: as AI agents gain the ability to take real actions inside the enterprise, there have to be hard limits on what they can do autonomously.

Gemini Enterprise is being built around Agent Identity, enterprise IAM, policy controls and Agent Gateway. Google now gives security teams the ability to govern which agents can reach particular resources, which tools they can invoke and whether certain actions are permitted. Importantly, those policies can explicitly distinguish destructive or irreversible actions from routine ones.

That tells us something important: Google recognizes that agentic AI needs gates.

For ordinary work, agents should operate autonomously. That is the value proposition. But an agent that is about to move money, change privileged access, delete production data, deploy code or release sensitive information should encounter a fundamentally different control point. Somewhere in the workflow, the system needs to stop and require human authorization.

The security problem is that not every approval mechanism actually proves a human approved anything.

An email approval can potentially be generated or acted upon by software. A traditional MFA prompt can be triggered and approved through an authenticated session. A software based passkey may be available to an agent operating within a user’s device or cloud identity environment. As agents become more capable and are given access to email, browsers, identity systems and enterprise workflows, we should assume that agents will eventually become capable of satisfying weak approval processes intended for humans.

That creates a dangerous possibility: one agent effectively approving another agent.

If we do not explicitly prevent that, it will happen. The entire purpose of a human approval gate is defeated if another software process can cross it. An agent should not be able to authorize another agent’s destructive action simply because it has inherited a user session, has access to an inbox or can exercise credentials available in software. This is where biometric hardware becomes critical.

TokenCore products use FIDO2 authentication combined with a live fingerprint match on dedicated hardware. The authentication credential is hardware bound, the request is tied cryptographically to the legitimate service, and the authorized user must physically interact with the device.

That creates something an autonomous agent cannot manufacture on its own: proof of a human.

The distinction matters. Agent Identity can prove which agent made a request. IAM can establish whether that agent has permission to attempt an action. Agent Gateway can enforce whether the action is allowed. But when a policy says a consequential action requires human authorization, the final control needs to establish that a human actually participated in the decision. That is where TokenCore fits naturally into Google’s architecture.

Agent Gateway already acts as an inline policy enforcement point between agents and enterprise resources, with support for IAM conditions, delegated authorization and custom authorization engines. An enterprise can therefore define a class of actions that agents are simply not permitted to complete without a fresh human authentication step.

The agent can prepare the transaction. It can analyze the data. It can recommend the action. It can assemble everything necessary to execute it. But when it reaches the biometric gate, it stops.

The authorized person touches a TokenCore Wearable ring, Node or other TokenCore authenticator. The fingerprint is verified on the dedicated hardware. Only then can the action continue.

That is a much stronger definition of human in the loop. It does not mean that a user clicked a button, responded to an email or happened to have an authenticated session open. It means the system received cryptographic proof that the authorized human was physically present and deliberately approved the action.

Google is clearly building agent identity, least privilege and policy enforcement into the foundation of Gemini Enterprise because autonomous agents require hard security boundaries. The next question for every CISO is what happens at the most important of those boundaries.

If an agent can approve another agent, it is not a human gate. For consequential and irreversible actions, the enterprise needs a control that software cannot satisfy by itself. That control must be isolated and secure biometric.

I think the key new line is “If an agent can approve another agent, it is not a human gate.” That is the memorable security thesis for the whole piece.