# Google Cloud extends Agent Identity into Cloud Run with automatic Agent Registry registration Google Cloud’s Agent Identity credential broker is now joined by a preview Cloud Run integration: services and jobs can be declared as agents or MCP servers, receive lifecycle-bound system-managed identities and register automatically in Agent Registry. Agent Identity is moving from a standalone credential boundary into a mainstream serverless runtime. Cloud Run can now assign agent identities and register agents/MCP servers automatically, reducing custom discovery and identity plumbing while keeping the runtime integration itself in Preview. - Status: Active - Published: 2026-08-31T06:26:43+12:00 - Updated: 2026-09-05T17:16:13+12:00 - Categories: Artificial Intelligence, Web Development, Cloud & Infrastructure, AI Agents, Cloud Platforms, Developer Tools - Tags: Agent Identity, Agent Registry, AI agents, API authentication, Cloud Run, Google Cloud, OAuth, SPIFFE - Canonical HTML: https://beyondthe.news/dossiers/google-cloud-agent-identity-auth-manager-ga-credential-broker ## Latest material change Updates dossier #212 for the September 1 Cloud Run Agent Platform Preview. Agent Identity now extends directly into Cloud Run services/jobs with system-managed agent identities, default identity certificates and automatic Agent Registry/MCP server registration. This is a material runtime expansion of the existing Agent Identity storyline, not a separate dossier. ## What changed Google Cloud made Agent Identity auth manager and its supporting APIs generally available in August, providing a managed credential vault and authentication broker for agent tool calls. On September 1, Cloud Run added Preview support for Agent Platform functional and identity types. A Cloud Run service or job declared as an `agent` must use a system-managed `agent-identity`, receives identity certificates by default and is automatically registered as an agent in Agent Registry. A service declared as an `mcp-server` is automatically registered in the MCP server catalog and can use either an Agent Identity or a standard service account. The functional and identity properties become part of the workload configuration and cannot simply be unset after assignment. ## Why it matters The original GA milestone solved credential brokerage, but builders still had to connect identities, runtimes and discovery. Cloud Run now turns those into deployment-time primitives: an agent can get a workload-specific identity tied to its lifecycle, advertise itself in a central registry and authenticate to tools or Google APIs without a bespoke registration system. Because the Cloud Run integration is Preview, teams should separate the maturity of the core Agent Identity/auth-manager service from the newer runtime and registry automation. ## The credential broker remains the GA security boundary Agent Identity auth manager stores and brokers API keys and OAuth credentials under IAM policy, using dedicated agent identities instead of embedding third-party secrets in application code. That core service remains the foundation of the storyline. ## Cloud Run now understands an agent as a workload type Cloud Run resources can declare a functional type of `agent` or `mcp-server`. Agent workloads must pair that declaration with the system-managed agent-identity type, making identity an explicit runtime property rather than an application convention. ## Registration follows deployment automatically Cloud Run agents are automatically added to the Agent Registry agent catalog, while MCP servers are added to the MCP server catalog. That gives organizations a discovery surface without maintaining a separate inventory for supported Cloud Run workloads. ## Identity certificates are enabled by default For workloads using Agent Identity, Cloud Run enables identity certificates by default. Google documents the identity as suitable for agents acting on their own authority or on behalf of users when authenticating to tools and resources. ## The runtime integration is still Preview The Cloud Run Agent Platform feature is explicitly pre-GA even though the core Agent Identity auth manager and APIs are GA. Builders should avoid treating the whole stack as one maturity level and should verify Preview terms, support and rollback behavior before standardizing critical production agents on it. ## Key details - Agent Identity auth manager and Agent Identity APIs are GA. - Cloud Run Agent Platform features are Preview as of September 1, 2026. - Cloud Run services and jobs can be configured with agent or MCP-server functional types. - A workload declared as an agent must use a system-managed Agent Identity. - Agent identities receive identity certificates by default unless explicitly disabled. - Configured Cloud Run agents register automatically in Agent Registry. - Configured MCP servers register automatically in the MCP server catalog. - MCP servers can use an Agent Identity, a service account or the documented default identity behavior. - Google says the functional and identity type properties cannot be changed or unset arbitrarily after configuration. ## Builder takeaways - Separate the GA credential-broker decision from the Preview Cloud Run runtime-integration decision in architecture reviews. - Use workload-specific Agent Identities instead of shared long-lived credentials when an agent needs access to tools or Google APIs. - Let Agent Registry become the inventory source for supported Cloud Run agents/MCP servers rather than duplicating registration state where possible. - Test deletion, redeployment and identity rotation behavior because the identity is tied to workload lifecycle. - Review the immutability of functional/identity types before converting an existing service into an agent workload. - Keep least-privilege IAM and delegated-user authority distinct even when registration and identity assignment are automatic. ## What to watch - Cloud Run Agent Platform progression from Preview to GA. - Expansion of automatic Agent Registry registration to more runtimes and cross-project discovery. - Policy controls at individual tool or MCP-method level. - Operational behavior for identity rotation, workload cloning and disaster recovery. - Retirement timing for legacy IAM Connectors API dependencies. ## Uncertainties - Cloud Run’s Agent Platform integration is pre-GA and may change. - Automatic registration simplifies discovery but does not itself establish whether an agent is authorized to perform a specific action. - Agent Registry automatic discovery is project/runtime scoped and does not remove the need to model cross-project access. - Adjacent Google agent features have different launch stages, so builders must verify each dependency individually. ## Sources - [IAM release notes](https://docs.cloud.google.com/iam/docs/release-notes) — Google Cloud · primary · 2026-08-22T00:00:00+12:00. GA announcement for Agent Identity auth manager and APIs. - [Configure Agent Platform features for Cloud Run](https://docs.cloud.google.com/run/docs/ai/agent-platform-features) — Google Cloud · primary documentation · 2026-09-01T00:00:00+12:00. Cloud Run functional types, identity types, certificates, automatic registry behavior and Preview status. - [Cloud Run release notes](https://docs.cloud.google.com/run/docs/release-notes) — Google Cloud · primary · 2026-09-01T00:00:00+12:00. Primary release announcement for system-managed Agent Identities and automatic Agent Registry registration. - [Register agents](https://docs.cloud.google.com/agent-registry/register-agents) — Google Cloud · primary documentation · 2026-09-01T00:00:00+12:00. Automatic registration behavior across supported Google Cloud runtimes.