Google opens Marketplace path for AI agents in Gemini

Google Cloud has opened a path for developers to publish AI agents in Gemini Enterprise and Google Cloud Marketplace. The move sets out how third-party agents can be sold through Marketplace and deployed inside Google's workplace AI application.

Google has outlined the organisational and technical steps developers must follow to list what it calls Agent-as-a-Service products. These include Marketplace enrolment, protocol compliance, authentication, billing integration, and registration inside Gemini Enterprise.

The plan links three parts of Google's cloud estate. Customers discover and buy agents through Google Cloud Marketplace. Partners host the agents and procurement logic in their own projects. A separate partner Marketplace project manages procurement APIs and Pub/Sub notifications tied to account creation and entitlement approval.

At the centre of the approach is the Agent2Agent, or A2A, protocol, which Google is positioning as the interoperability layer for third-party agents. Developers must provide an A2A Agent Card, a JSON file describing the agent's skills, authentication methods, and service endpoints. This allows Gemini Enterprise to display metadata, locate endpoints, and determine access requirements.

Agents listed through the service must support either public access or OAuth 2.0 Authorisation Code Grant Flow. Public access is reserved for agents that do not handle user data or sensitive resources. OAuth is intended for cases where an agent acts on a user's behalf or accesses enterprise data.

Registration flow

Google also requires support for Dynamic Client Registration, or DCR, when an agent uses delegated authentication. Under this process, Gemini Enterprise can register itself as an OAuth client with the agent provider's authorisation server, avoiding the manual exchange of client IDs and secrets that often slows third-party integrations.

In practice, the Gemini Enterprise application reads the agent card, discovers the DCR endpoint, and sends a signed software statement as a JSON Web Token. The provider must validate the token using Google's public keys, then check the order identifier against its own records before returning credentials for the client registration.

That order check ties security to commercial control. Providers are expected to cross-reference the order ID in the token with their database to confirm that the customer has paid before allowing registration to proceed.

Marketplace process

For developers that want to sell these agents, the commercial process begins in Google Cloud's Producer Portal. Sellers must choose the "AI Agent as a Service" product type, upload the agent card from a Google Cloud Storage bucket, decide whether the product will be sold through public pricing or private offers, and configure a pricing model and backend procurement integration.

Before publication, Google reviews the agent's functionality, security, and pricing model. Once approved, the product becomes available through the dedicated AI agent category in Google Cloud Marketplace.

Google has also set out a governance model for enterprise customers. It splits responsibility between a Billing Administrator, who controls purchasing through Marketplace; a Discovery Engine Administrator, who registers approved agents inside Gemini Enterprise and manages access; and Discovery Engine Users, who can use the tools once access has been granted.

This creates a two-stage path from purchase to use. First, a Billing Administrator subscribes to the agent through Marketplace or accepts a private offer, triggering Pub/Sub notifications and entitlement approval through the partner's procurement system. The transaction is then recorded with a unique order ID.

Next, a Discovery Engine Administrator links the purchase to the customer's Gemini Enterprise environment. During this step, the registration process checks that the relevant Google Cloud project is tied to the same billing account used for procurement, and the DCR logic validates the order ID before the agent is registered for organisational use.

User access

After registration, end users can discover available partner-built agents in the Agent Gallery inside Gemini Enterprise and request access where needed. If the product has already been bought and registered, the Discovery Engine Administrator can grant access directly.

On first use, a user may be asked to complete OAuth authorisation with the partner system before the agent can operate within Gemini Enterprise. This is designed to let external agents work inside the Gemini interface while preserving billing oversight and administrator control.

Google cited Marketplace agents including Lovable Agent and Atlassian Rovo, indicating that the model is intended to support both self-service procurement and managed enterprise rollout. The framework also signals Google's effort to turn Marketplace into a distribution channel not just for software subscriptions, but for task-based AI services that can be invoked from within Gemini Enterprise.

Agents must comply with standard Marketplace requirements as well as agent-specific rules, including A2A adherence, creation of an agent card, support for approved authentication methods, and integration with procurement APIs and Pub/Sub for entitlement lifecycle management.