{"id":2772,"date":"2026-08-12T02:45:00","date_gmt":"2026-08-12T02:45:00","guid":{"rendered":"https:\/\/dmarketertayeeb.com\/blog\/?p=2772"},"modified":"2026-08-11T16:46:26","modified_gmt":"2026-08-11T16:46:26","slug":"gemini-managed-agents-marketing-workflows","status":"publish","type":"post","link":"https:\/\/dmarketertayeeb.com\/blog\/gemini-managed-agents-marketing-workflows\/","title":{"rendered":"Gemini Managed Agents Tutorial: Hooks, Budgets and Scheduled Marketing Workflows"},"content":{"rendered":"\n\n\n

Gemini Managed Agents<\/strong> let a developer start a long-running agentic job with the Gemini Interactions API while Google provisions and operates the Linux sandbox in which the agent reasons, writes and runs code, manages files and retrieves web material. Google\u2019s July 28, 2026 update added the controls that make the preview much more relevant to marketing operations: Gemini 3.6 Flash as the default, pre\/post tool hooks, a total-token budget, scheduled triggers, environment inspection and free-tier access.<\/p>\n\n\n\n\n\n\n\n

This is not another launch summary. It is an implementation guide for a controlled recurring workflow\u2014for example, collecting approved first-party marketing sources, producing a cited change brief and stopping before publication. The existing DMT agent-harness guide<\/a> owns the broader architecture; this page shows how to assemble and operate the Gemini-specific controls.<\/p>\n\n\n\n\n\n\n\n

\"Google<\/a>
Official Google illustration for the July 2026 Managed Agents update. Source: Google; captured August 11, 2026.<\/figcaption><\/figure>\n\n\n\n\n\n\n\n

Managed Agents in one table<\/h2>\n\n\n\n\n\n\n\n
Capability<\/th>Current official behaviour<\/th>Marketing implementation decision<\/th><\/tr><\/thead>
Agent harness<\/td>Antigravity managed agent via the Interactions API<\/td>Use for bounded, multi-step jobs that genuinely need code\/files\/web; do not use it for a single summary<\/td><\/tr>
Default model<\/td>Gemini 3.6 Flash for the preview agent<\/td>Pin a model when reproducibility or cost comparison matters<\/td><\/tr>
Environment<\/td>Isolated remote Linux sandbox with Python 3.12 and Node 22<\/td>Keep secrets out of prompts\/files; configure outbound network restrictions<\/td><\/tr>
Hooks<\/td>Pre- and post-tool command or HTTP handlers<\/td>Block unapproved tools\/domains before execution; validate outputs after writes<\/td><\/tr>
Budget<\/td>max_total_tokens<\/code> covers input, output and thinking<\/td>Set a task-level ceiling and handle incomplete<\/code> as a normal state<\/td><\/tr>
Scheduling<\/td>Triggers bind an agent, environment, prompt and cron schedule<\/td>Reuse durable files carefully; persist cursors and receipts, not uncontrolled state<\/td><\/tr>
Network<\/td>Outbound network is unrestricted by default<\/td>Apply an allowlist; \u201csandboxed\u201d does not mean \u201cno internet\u201d<\/td><\/tr>
Preview economics<\/td>Free tier available; environment compute unbilled during preview; model tokens still matter<\/td>Instrument tokens, tools, retries and review time; do not assume future pricing<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\n\n\n\n

The reference workflow: a controlled marketing change monitor<\/h2>\n\n\n\n\n\n\n\n

The example job checks an allowlist of official product\/documentation pages, compares them with the previous run, writes a source ledger and a concise marketing-impact brief, then stops for human approval. It does not publish, send messages or crawl arbitrary sites.<\/p>\n\n\n\n\n\n\n\n

  1. Read state\/cursors.json<\/code> and the source allowlist.<\/li>
  2. Fetch only allowed URLs; record status, canonical URL and retrieval time.<\/li>
  3. Diff normalized text or structured release data against the previous snapshot.<\/li>
  4. For material changes, write output\/change-brief.md<\/code> and output\/source-ledger.json<\/code>.<\/li>
  5. Run a post-write validator that rejects uncited material claims and unexpected domains.<\/li>
  6. Return the files and a machine-readable run receipt.<\/li>
  7. Require a human or separate release worker to decide whether any content should be created or published.<\/li><\/ol>\n\n\n\n\n\n\n\n

    This separation is important. A useful content machine has discovery, qualification, production and release states; combining all four in one autonomous prompt hides errors and makes rollback difficult.<\/p>\n\n\n\n\n\n\n\n

    1. Install the official SDK and create a client<\/h2>\n\n\n\n\n\n\n\n

    Google\u2019s announcement uses the official @google\/genai<\/code> JavaScript\/TypeScript SDK<\/a>. Install it in a dedicated project and supply the API key through the environment or your secret manager\u2014not a checked-in source file.<\/p>\n\n\n\n\n\n\n\n

    npm install @google\/genai\n\n# optional: install Google's Interactions API skill in a coding assistant\nnpx skills add google-gemini\/gemini-skills --skill gemini-interactions-api<\/code><\/pre>\n\n\n\n
    Use a project without active billing if you are deliberately testing the free tier, but still implement a budget. \u201cFree tier\u201d is an access\/pricing state, not protection from runaway logic or future pricing changes.<\/p>\n\n\n\n\n\n\n\n
    2. Start the managed interaction with an explicit budget<\/h2>\n\n\n\n\n\n\n\n
    import { GoogleGenAI } from \"@google\/genai\";\n\nconst client = new GoogleGenAI({});\n\nconst interaction = await client.interactions.create({\n  agent: \"antigravity-preview-05-2026\",\n  input: `Run the approved marketing change-monitor workflow.\nRead \/workspace\/config\/sources.json.\nFetch only allowed domains.\nWrite \/workspace\/output\/change-brief.md and source-ledger.json.\nDo not publish, email, post, or modify an external system.`,\n  agent_config: {\n    type: \"antigravity\",\n    model: \"gemini-3.6-flash\",\n    max_total_tokens: 20000\n  },\n  environment: \"remote\"\n});\n\nconsole.log(interaction.status);\nconsole.log(interaction.output_text);<\/code><\/pre>\n\n\n\n
    max_total_tokens<\/code> covers input, output and thinking. Pick the number from a measured dry run plus a modest safety margin. A very high cap is not a plan; it merely moves the failure boundary.<\/p>\n\n\n\n\n\n\n\n
    3. Add pre-tool and post-tool hooks<\/h2>\n\n\n\n\n\n\n\n
    Place hook configuration in .agents\/hooks.json<\/code> inside the managed environment. A pre-tool hook can deny a call before it executes. A post-tool hook can lint, normalize, scan or validate the result after execution. Google supports command and HTTP handlers and regular-expression matchers.<\/p>\n\n\n\n\n\n\n\n
    {\n  \"source-policy\": {\n    \"pre_tool_execution\": [\n      {\n        \"matcher\": \"web_fetch|code_execution|write_file\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"python3 \/.agents\/hooks-scripts\/policy_gate.py\",\n            \"timeout\": 10\n          }\n        ]\n      }\n    ]\n  },\n  \"evidence-check\": {\n    \"post_tool_execution\": [\n      {\n        \"matcher\": \"write_file\",\n        \"hooks\": [\n          {\n            \"type\": \"command\",\n            \"command\": \"python3 \/.agents\/hooks-scripts\/validate_evidence.py\",\n            \"timeout\": 20\n          }\n        ]\n      }\n    ]\n  }\n}<\/code><\/pre>\n\n\n\n
    A denial response follows Google\u2019s documented pattern: {\"decision\":\"deny\",\"reason\":\"...\"}<\/code>. The reason returns to the model so it can choose a compliant next step. Your gate should default to deny when input is malformed, a domain is not allowlisted or the requested action exceeds the run\u2019s mutation policy.<\/p>\n\n\n\n\n\n\n\n
    Control<\/th>Pre-tool check<\/th>Post-tool check<\/th><\/tr><\/thead>
    Source rights<\/td>URL domain\/path is on the allowlist<\/td>Ledger contains source URL, owner and capture time<\/td><\/tr>
    Filesystem<\/td>Write target stays under \/workspace\/output<\/code> or \/workspace\/state<\/code><\/td>Required files exist and parse<\/td><\/tr>
    External mutation<\/td>Deny email, social, CMS and unknown network tools<\/td>Receipt proves zero external writes<\/td><\/tr>
    Claims<\/td>Prompt requires primary evidence<\/td>Every material claim maps to a ledger entry<\/td><\/tr>
    Secrets<\/td>Reject credentials in tool arguments<\/td>Scan output for secret patterns before return<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\n\n\n\n
    4. Treat network access as a separate security boundary<\/h2>\n\n\n\n\n\n\n\n
    Google describes the sandbox as OS-isolated, but outbound network is unrestricted by default. Those are different controls. A compromised dependency or an over-broad prompt can still send data outward if you permit arbitrary egress. Configure the environment\u2019s network allowlist for the exact official domains and package registries required by the task.<\/p>\n\n\n\n\n\n\n\n