Managed Agents in Production: Hooks, Budgets, and Sandboxed Reliability

On July 28, 2026, Google announced that Managed Agents in the Gemini API now default to Gemini 3.6 Flash, with three production-grade additions: environment hooks that run your scripts before and after every tool call, budget controls with scheduled triggers, and free tier access. Combined with the earlier release of background tasks and remote MCP server integration, a single API call now coordinates reasoning, code execution, package installation, file management, and web retrieval inside an isolated cloud sandbox. This guide shows with runnable code how to wire these capabilities into production.

One API call, all work in an isolated sandbox

1. One API Call Runs the Whole Agent

Code sample 1 shows Managed Agents in action: client.interactions.create makes a single call, and the agent audits dependencies, upgrades outdated packages, and verifies the build with npm test inside a remote sandbox. The default model is already Gemini 3.6 Flash (antigravity-preview-05-2026) — no code changes required; to save money, pin gemini-3.5-flash-lite explicitly. For teams that don't want to build agent infrastructure themselves, this is the fastest on-ramp in 2026.

# One API call coordinates reasoning, code execution, package
# installation, file management, and web retrieval in a sandbox.
import { GoogleGenAI } from "@google/genai";

const client = new GoogleGenAI({});

const interaction = await client.interactions.create({
  agent: "antigravity-preview-05-2026",
  input: "Audit all dependencies in package.json, upgrade outdated packages, " +
         "and verify the build by running npm test.",
  environment: "remote",
  agent_config: {
    type: "antigravity",
    model: "gemini-3.5-flash-lite",   // pin a cheaper model explicitly
  },
});

console.log(interaction.output_text);
// Gemini 3.6 Flash is the new default; no code changes required.

2. Environment Hooks: Block, Lint, Audit

Environment hooks route every tool call the agent makes through your code. Code sample 2 shows .agents/hooks.json defining two groups: the security-gate group runs gate.py before every code_execution or write_file call; the auto-format group runs auto_lint.py after every tool finishes to enforce styling. The matcher supports regular expressions — use | to target multiple tools or * to catch everything — and http type handlers can POST events to external endpoints.

# Environment hooks: run your own scripts before/after every tool call.
# .agents/hooks.json
{
  "hooks": [
    {
      "matcher": "code_execution|write_file",
      "event": "pre_tool_execution",
      "group": "security-gate",
      "command": "python gate.py"
    },
    {
      "matcher": "*",
      "event": "post_tool_execution",
      "group": "auto-format",
      "command": "python auto_lint.py"
    }
  ]
}
# The matcher supports regex: "|" targets multiple tools, "*" catches all.
# Groups run in parallel; http type handlers can POST to external endpoints.

3. Deny Is Context: Let the Agent Self-Correct

Code sample 3 is the deny logic in gate.py: when the agent tries to write into secrets/, the hook returns {"decision": "deny", "reason": "..."}, the tool call is skipped, and the rejection reason is passed into the model's context — the agent can self-correct on the spot. That's an order of magnitude better than post-hoc auditing: not recording what happened, but deciding what's allowed to happen.

# gate.py — deny a tool call before it executes
#!/usr/bin/env python3
import json, sys

payload = json.load(sys.stdin)
tool = payload.get("tool", "")
args = payload.get("args", {})

if tool == "write_file" and "secrets/" in args.get("path", ""):
    print(json.dumps({
        "decision": "deny",
        "reason": "Writing into secrets/ is forbidden for agents"
    }))
    sys.exit(0)

print(json.dumps({"decision": "allow"}))
# A deny decision skips the tool call and passes the reason
# into the model's context — the agent can self-correct.

4. Budget, Schedule, and MCP: The Production Trio

Code sample 4 shows the production config: max_cost_usd, max_steps, and max_tokens cage the agent inside a cost boundary; a cron schedule runs nightly maintenance automatically; remote MCP servers let the agent read Postgres and query Jira. The real-world case is Offdeal, an AI-native investment bank: post_tool_execution hooks automatically verify 30+ company logos per deck inside the sandbox — every logo must be the right company, size, and aspect ratio, with a transparent background and high contrast on white.

# Budget controls + scheduled triggers keep managed agents in bounds
# (conceptual config for the Gemini API)
{
  "agent": {
    "model": "gemini-3.6-flash",
    "budget": {
      "max_cost_usd": 25.0,
      "max_steps": 200,
      "max_tokens": 200000
    },
    "schedule": {
      "cron": "0 2 * * *",          // nightly maintenance window
      "timezone": "UTC"
    },
    "mcp_servers": ["remote:postgres", "remote:jira"]
  }
}
# Offdeal, an AI-native investment bank, uses post_tool_execution hooks
# to verify 30+ company logos per deck automatically inside the sandbox.

5. Practical Recommendations

First, run one real task on the default model, then switch to Flash-Lite if cost matters. Second, write the security-gate hooks first (block secrets writes, block dangerous commands), then add auto-format hooks. Third, give every agent task a budget cap. Fourth, move repetitive nightly jobs to scheduled triggers. Fifth, when connecting internal systems via remote MCP, make sure hooks still cover those tool calls.

6. Summary

Managed agents turn "reliable" from a slogan into infrastructure: sandboxed execution, hooks that gate every tool call, budgets that lock down cost, and schedulers that automate operations. With the default model upgraded to 3.6 Flash, 2026 managed agents finally feel trustworthy enough for production — provided you configure the hooks and budgets.