Author Archives:

Build zero-trust AI agents with Google’s Agent Development Kit

Building autonomous AI agents that mutate production state requires moving beyond soft system prompts to a robust zero-trust architecture. To secure Google Agent Development Kit (ADK) workflows against prompt injections and malicious execution, developers must implement hardware-backed cryptographic signatures for database writes, kernel-level sandboxing with gVisor for dynamic code, and deterministic semantic gateways for I/O validation. By enforcing these hard security boundaries at the infrastructure level, you can safely deploy multi-tool AI agents without risking unauthorized data manipulation or server compromise.

Use Gemini to help manage Google Workspace for your organization

We are introducing Admin Assist, bringing two new Gemini-powered capabilities to the Google Admin Console: the Sidepanel and Search Overviews. Designed to simplify complex administrative workflows and troubleshooting, this launch makes managing Google Workspace easier and faster. Admin Assist is available for customers with Google Workspace Business editions only.

Previously, administrators often had to toggle back and forth between different browser tabs, troubleshooting documentation, and the console to manage domain policies. With this update, we are integrating conversational AI assistance directly into your Google Workspace management surface to provide instant, contextual support.

  • Gemini-powered Sidepanel: Conveniently accessible via the One Google Bar (OGB) on most of the pages of the Admin Console. Super admins can use the sidepanel to get help with complex tasks, learn about administrative best practices, and receive interactive, step-by-step guidance.
  • Gemini-powered Search Overviews: A proactive search feature that triggers when you ask a question in the main Admin Console search bar. Admin Assist will automatically synthesize Google Workspace Help Center articles into conversational summaries, presenting you with the exact answers you need alongside direct, actionable next steps.

Whether you are looking to audit application usage or investigate configuration drifts, Admin Assist acts as your personal technical co-worker—allowing you to manage your domain securely and efficiently.

Getting started

  • Super Admins: This feature will be ON by default for Super Admins with eligible Business SKU editions (see ‘Availability’ below). It is not available to Delegated Admins.
  • End users: There is no end-user setting or impact for this feature, as these capabilities are restricted exclusively to Super Admins at the Google Admin Console.

Rollout pace

Availability

  • Business: Business Starter, Standard, and Plus

Make a copy of a notebook in Gemini Notebook

Gemini Notebook users can now copy entire notebooks, including all associated sources and studio items, if they have copy permission for that notebook. This capability allows users to build upon existing work or templates shared by others. For example, a student can copy a notebook shared by a teacher, and then add their personal study notes and generate customized practice quizzes or flashcards to that copy, or a coworker can copy a notebook with foundational information and add on additional sources to tailor it to a specific project.

When you make a copy of a notebook, several key components are copied to the new user's library. This includes sources and studio content.

A few notes:

  • Sources: Drive-based sources are only included if the user performing the copy has permission to access and copy the original Google Drive file.
  • Studio content: This includes studio artifacts like Audio Overviews, Video Overviews, Study Guides, Flashcards, Quizzes, and Slide Decks, plus artifact generation prompts and custom chat configurations. 

Personal chat history and user-generated notes are not transferred to the new notebook. Additionally, a copied notebook does not sync with the original, so any subsequent updates made by the original owner do not overwrite the copied version.

Getting started

Rollout pace

Availability

  • Available to all Google Workspace customers and users with personal Google accounts with access to Gemini Notebook

Resources

New enterprise security controls for Workspace Studio enable expanded collaboration use cases

Workspace Studio enables users to boost their productivity with custom, no-code agentic automation. Today, we are adding a new set of enterprise security controls to enable additional collaboration use cases. These granular identity, data protection, observability, and governance controls provide admins with more confidence to safely enable and adopt agentic capabilities in their organization.

Built-in, enterprise security controls in Workspace Studio include:

  • Agent identities
  • Agent access management
  • Agent auditing and observability
  • Admin settings / human-in-the-loop (HiTL)
  • Runtime protections

Collaboration use cases

When Studio initially launched, it was only able to assist users in their tasks, such as drafting an email, not executing tasks autonomously, such as sending an email. Now, Studio supports cross-user collaboration through the introduction of several new steps with built-in guardrails.



Collaboration actions in Studio Flows

Agent identities: Automation with flows in Studio will continue to run with the user’s identity, but in a least-privileged way. This means that the flow will have the minimal set of privileges required to run, and not the full set of privileges the owner has. When the flow executes, it will do so with a unique, auditable identifier. Note: the least-privilege agent identity will apply to newly created flows only.  Existing flows will be supported in the future.

(Beta) Identity attribution: Admins, through a new setting, will be able to decide whether the actions taken by a flow show the owner's identity, or are attributed to the flow itself, with the owner information made visible.  This will default to “on”; meaning the actions by the flow will be attributed to the flow. Note: the agent identity attribution setting will apply to newly created flows only.  Existing flows will be supported in the future.

Flow represented as the owner's identity

" Flow attributed as the flow’s name with owner’s information

Auditing and observability: Actions in Studio across configuration and execution events are recorded in Studio audit events. Additionally, audit events for actions, such as edits made to a file in Drive or emails sent in Gmail, will include flow context, such as a unique flow identifier and the owner’s information. Note: agent context in audit logs will apply to newly created flows only. Existing flows will be supported in the future.

Agent access management: In the admin console, an Agent access management dashboard gives admins the ability to suspend all flows or targeted OAuth scopes for individual flows, such as revoking Drive access. Additionally, the security investigation tool enables admins to transition directly from an audit event to the agent access management page, facilitating swift remediation during incident investigations. Note: after the rollout, newly created flows will be shown in Agent access management.  Existing flows will be supported in the future.



Agent access management dashboard


Admin settings & human-in-the-loop: Additional admin settings will support disabling specific step types for flows, disabling Gemini data access, enforcing end-user confirmation for steps that share data externally, and disabling webhook integrations.



Flow asking for human approval before it sends an email externally


Runtime protections: Additional data loss prevention (DLP) features for Gemini data access and Studio flows are available for added protection. Gemini DLP restricts Gemini’s ability to access Drive data based on content conditions and labels, with support for additional services coming soon. Agent DLP will support restrictions on Studio flow execution, including blocking or enforcing end-user review, based on conditions of the sourced data, utilized data, and data visibility of the output.



Studio DLP

Rollout pace

Admin console settings

End-user visible features

(Beta) Identity attribution

Getting started

Availability

Available for Google Workspace*:

  • Business Starter,  Standard, and Plus
  • Enterprise Starter, Standard, and Plus
  • Education Fundamentals, Standard, and Plus

Also available to*:

  • Google AI Pro for Education
  • Google AI Ultra for Business

* Gemini DLP, and DLP for Studio are available only for Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus

Enhanced external sharing insights now available in Drive Inventory Reporting

Administrators using Drive Inventory Reporting in Google BigQuery can now access granular external sharing fields designed to simplify complex permission structures. By automatically consolidating direct permissions, group memberships, and public links into clear signals, this update helps organizations easily identify external exposure across their Drive environments.

Administrators can now distinguish between human users, service accounts, and files published to the web, as well as cross-reference sharing attributes with existing Data Loss Prevention (DLP) metadata to prioritize remediation for high-risk data.

Getting started

  • Admins: This feature will be OFF by default and can be enabled via the "External sharing calculations" setting under Drive inventory report settings in the Google Admin console. Note that for organizations with large Google groups, enabling this calculation may extend processing time and impact report delivery schedules.

Rollout pace

Availability

  • Enterprise: Enterprise Standard, and Plus
  • Education: Education Standard, and Plus
  • Other Editions: Frontline Plus; Enterprise Essentials Plus; Cloud Identity Premium

Resources

Google Workspace Weekly Recap – August 14, 2026

Improved file importing in Google Sheets with tables and linked pivot tables

We’re introducing two key improvements in Google Sheets that preserve formatting and linked data when converting files from Microsoft Excel. First, Excel tables will now seamlessly import as Sheets tables. Second, Sheets now fully supports importing Excel pivot tables that are backed by table ranges. | Learn more.

New usability features in Connected Sheets

Google Workspace is introducing two usability enhancements to Connected Sheets to improve data presentation and give more flexibility when analyzing BigQuery data. | Learn more.

Use Sheets canvas to visualize data in custom, interactive mini-apps

We’re excited to launch Sheets canvas, a new Gemini-powered capability that transforms your spreadsheets into custom, interactive, read-write applications using simple natural language prompts. It acts as a dynamic visualization layered directly on top of your spreadsheet data, allowing you and your team to work in layouts that best fit your workflows. | Learn more.

Take Notes for me for in-person meetings is now available

We know that balancing active participation with note taking during face-to-face discussions can be a challenge. You shouldn't have to choose between staying present in the moment and capturing critical context for later. We’re excited to start rolling out a new way to make Google Meet the home for all of your meetings, expanding beyond just video calls to support your in-person collaboration.  | Learn more.

New admin controls for adding invitations to Google Calendar

Google Calendar users have three options for how event invitations are added to their calendar: auto-add invitations from everyone, auto-add invitations from known senders only, or add invitations only after the user responds in email. To date, administrators can only choose the default value for users in their organization. | Learn more.

The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

Beta Channel Update for ChromeOS / ChromeOS Flex

The Beta channel is being updated to OS version 16765.19.0 (Browser version 152.0.7977.39) for most ChromeOS devices.

If you find new issues, please let us know one of the following ways:


  1. File a bug

  2. Visit our ChromeOS communities

    1. General: Chromebook Help Community

    2. Beta Specific: ChromeOS Beta Help Community

  3. Report an issue or send feedback on Chrome

  4. Interested in switching channels? Find out how.


Luis Menezes

Google ChromeOS

New admin controls for adding invitations to Google Calendar

Google Calendar users have three options for how event invitations are added to their calendar: auto-add invitations from everyone, auto-add invitations from known senders only, or add invitations only after the user responds in email. To date, administrators can only choose the default value for users in their organization.

With this release, we’re expanding Calendar settings in the Admin console to offer organizations more granular controls on invitations.  Administrators can now determine the invitation options available to end users, providing organizations more control over inbound event invitations from unknown senders and minimizing potential security risks from the content contained within them.


Getting started

Rollout pace

Availability

  • Available to all Google Workspace customers

Resources

Google Ads language targeting changes starting September 2026

We're making changes to language targeting for Search, AI Max for Search, and Performance Max campaigns in Google Ads, simplifying campaign management while maintaining a high-quality ad experience.

Effective late September 2026:

  • For Search and AI Max for Search campaigns, the campaign-level language targeting setting will be removed. Search ads will automatically match based on the language of your ads.
  • For Performance Max campaigns, the way language targeting is used will be updated:
    • On Google Search: The campaign-level language setting will no longer be used for ads shown on Google Search. Language matching will function the same as Search campaigns, using the language of your ads.
    • On other channels (like YouTube, Display, Discover, Gmail): The campaign-level language setting you select will continue to be used to guide who sees your ads.

In cases where multiple eligible campaigns exist within your account, AI-based ad group prioritization will select the most relevant ad language.

Historically, the language criterion in the Google Ads API allowed you to manually specify target languages for your campaigns. These language criteria will still be returned when querying even though they are not used for targeting. Any mutates to add or update Search campaign CampaignCriterion.language will result in a ContextError.OPERATION_NOT_PERMITTED_FOR_CONTEXT error. For Performance Max campaigns, there will be no error as language targeting may be used on other channels.

What should I change for the Google Ads API?

While existing Search and AI Max for Search campaigns will continue to operate without disruption (as their language settings will not apply), we recommend the following code updates:

  1. Stop setting language criteria:
    • For new Search campaigns: Stop including language criteria when creating or updating Search campaigns when sending Google Ads API requests.
    • For existing Search campaigns: You may optionally remove existing language criteria from your Search campaigns for cleanliness, though it is not strictly required as they will not apply.
    • Focus on Ad and Landing Page Language: Ensure your ad creatives and landing pages are clearly structured in the intended languages. Search ads will primarily use these signals, alongside user language preferences, for matching.

Where can I get support?

For technical support issues, please reach out to us using the support form. If you have any questions or want to discuss this post, please reach out to us on our “Google Advertising and Measurement Community” Discord server.

 - Dora Sun - Google Ads API Team