---
sourceDocument: Australia Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/intelligent-experiences

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Add a Gemini Enterprise Agent Platform connection

# Add a Gemini Enterprise Agent Platform connection {#ariaid-title1}

Release version: Australia  
Updated July 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read  
Connect Gemini Enterprise Agent Platform to AI Control Tower using a service account and OAuth 2.0 JWT Bearer authentication, so policies and AI agent containment using kill switch protocol can reach and act on agents running on Gemini Enterprise Agent Platform.

## Before you begin

Confirm the following:

* A GCP project with the Vertex AI API enabled and IAM permissions to create a service account.
* A GCP service account granted three IAM roles.

{#aict-configure-gcp-vertex-ai-connection__table_gcp_iam_roles__entry__3}

| Role | Scope | Purpose |
|-|-|-|
| `roles/iam.denyAdmin` | Organization or folder level only | Create and delete the Deny policy used to contain an agent. |
| `roles/aiplatform.viewer` | Project level | Read the agent's identity from Vertex AI. |
| `roles/resourcemanager.projectViewer` | Project level | Resolve the GCP project ID. |
[Table 1. Required IAM roles]

{#aict-configure-gcp-vertex-ai-connection__table_gcp_iam_roles}

* Download a JSON key for the service account. In the Google Cloud console, go to IAM \& AdminService accounts, select the service account, then select Add key \> Create new key and choose JSON as the key type. You'll need the `private_key`, `private_key_id`, `client_email`, and `token_uri` values from this file in the steps below.
* For each ADK-based AI agent you want containment to cover, enable Agent Identity. Create an .agent_engine_config.json file with `{ "identity_type": "AGENT_IDENTITY" }` and follow [Create and deploy an agent with Agent CLI and Agent Identity](https://docs.cloud.google.com/iam/docs/create-and-deploy-agent) to deploy the agent with a unique identity.  
  Important:  
  AI agent containment is supported only for Gemini Enterprise Agent Platform agents that have a unique agent identity configured this way.

Role required: creating the OAuth, JWT, and certificate records in steps 1--8 below
typically requires an instance admin or integration admin role. Creating the security
connector in steps 9--11 requires sn_ai_governance.ai_steward.

## About this task

Gemini Enterprise Agent Platform authenticates using OAuth 2.0 with a JWT Bearer grant, which requires more setup than an access-key based connection: you convert the service account key into a Java Key Store, build a chain of OAuth
and JWT records from it, and then attach the resulting Connection \& Credential Alias to the security connector.

## Procedure

1. Create the X.509 certificate.  
   Convert the service account's private key into a Java Key Store
   (.jks) file and import it as an X.509 Certificate. See the
   ServiceNow documentation on converting a private key to a Java Key Store. If your
   team already has a pre-generated .jks bundle, you can upload it
   directly instead.
   {#aict-configure-gcp-vertex-ai-connection__table_gcp_cert_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name, such as the service account's email address. |
   | Type | Select Java Key Store. |
   | Key store password | Password used when the .jks file was created. |
   | Active | Select this option. |
   [Table 2. Certificate (sys_certificate) fields]

   {#aict-configure-gcp-vertex-ai-connection__table_gcp_cert_fields}
2. Create the JWT Keys record.  
   Navigate to JWT Keys and create a new record.
   {#aict-configure-gcp-vertex-ai-connection__table_gcp_jwt_keys_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name. |
   | Signing Keystore | The certificate record from the previous step. |
   | Key Id | The `private_key_id` value from the service account JSON key. Copy it directly. |
   | Signing Algorithm | Select RSA 256. |
   | Signing Key | The password used to create the certificate in the previous step. |
   | Active | Select this option. |
   [Table 3. JWT Keys fields]

   {#aict-configure-gcp-vertex-ai-connection__table_gcp_jwt_keys_fields}
3. Create the JWT Provider record.  
   Navigate to JWT Provider and create a new record with the following:
   * Name: descriptive name.
   * Signing Configuration: the JWT Keys record from the previous step.
   * Expiry Interval (sec): `3600`.

   Add these Standard Claims:
   * `aud`: The `token_uri` value from the service account key (typically `https://oauth2.googleapis.com/token`).
   * `iss`: The `client_email` value from the service account token.
   * `sub`: The `client_email` value from the service account token.

   Add this Custom Claim:
   `scope : https://www.googleapis.com/auth/cloud-platform`
4. Create the Application Registry record.  
   Navigate to Application Registries and create a new
   OAuth Provider record.
   {#aict-configure-gcp-vertex-ai-connection__table_gcp_app_registry_fields__entry__2}

   | Field | Description |
   |-|-|
   | Name | Descriptive name. |
   | Provider Type | Select Connect to a third-party OAuth Provider -- Outbound (or the equivalent option on your instance). |
   | Default Grant Type | Select JWT Bearer. |
   | Client ID | The `client_id` value from the service account JSON key you generated earlier. |
   | Client Secret | The `private_key` value from the service account JSON key, with `\n` sequences converted to actual newlines. |
   | Authorization URL | `https://accounts.google.com/o/oauth2/auth` |
   | Token URL | `https://oauth2.googleapis.com/token` |
   | Refresh Token Lifespan | `8640000` |
   | Active | Select this option. |
   [Table 4. Application Registry (OAuth Provider) fields]

   {#aict-configure-gcp-vertex-ai-connection__table_gcp_app_registry_fields}

   Under OAuth Entity Scopes, add a scope named
   Vertex AI Scope with the value
   `https://www.googleapis.com/auth/cloud-platform`.
5. Update the default OAuth Entity Profile.  
   Open the default profile that was automatically created for the OAuth Provider in
   the previous step, and set:
   * Grant type: JWT Bearer.
   * JWT Provider: the JWT Provider record from the earlier step.
   * Is default: select this option.

   Add Vertex AI Scope under OAuth Entity Profile Scopes.
6. Create the OAuth 2.0 Credentials record.  
   Navigate to OAuth 2.0 Credentials and create a new record with
   the following:
   * Name: descriptive name.
   * OAuth Entity Profile: the profile from the previous step.
   * Applies to: All MID servers (or as appropriate for your instance).
   * Active: select this option.

   Use the Get OAuth Token related link to confirm the
   credential retrieves a token successfully.
7. Create the Connection \& Credential Alias.  
   Navigate to Connection \& Credential Aliases and create a
   new record with the following:
   * Name: descriptive name.
   * ID: a unique identifier for the alias.
   * Type: Connection and Credential.
   * Connection type: HTTP.
   * Default Retry Policy: Default HTTP Retry Policy.
8. Create the HTTP(S) connection.  
   From the Connections related list on the alias you just
   created, select New and fill in:
   * Name: descriptive name.
   * Credential: the OAuth 2.0 Credentials record from the earlier step.
   * Connection alias: the alias from the previous step.
   * Protocol: https.
   * Host: `iam.googleapis.com`.
   * Connection URL: `https://iam.googleapis.com`
   * Active: select this option.
9. Navigate to AI Control TowerSettingsIntegrationsControl Enforcement Points.
10. On the Available connectors sub-tab, select Gemini Enterprise Agent Platform.
11. Fill in the fields and select Submit.  
    {#aict-configure-gcp-vertex-ai-connection__table_gcp_connector_fields__entry__2}

    | Field | Description |
    |-|-|
    | Name | Unique, descriptive name for this connection. |
    | Connection Alias | The Connection \& Credential Alias you created in the previous steps. |
    | Active | Select this option. |
    [Table 5. Gemini Enterprise Agent Platform security connector fields]

    {#aict-configure-gcp-vertex-ai-connection__table_gcp_connector_fields}
{#aict-configure-gcp-vertex-ai-connection__steps_gcp_vertex}

## Result

The connector appears on the Established connections sub-tab. AI Control Tower can now use this connection to enforce policies and apply AI agent containment using kill
switch protocol to Gemini Enterprise Agent Platform agents that have a unique agent
identity configured.

To verify the setup:

* Confirm the HTTP connection appears in the Connections related list on the Connection \& Credential Alias.
* Confirm the OAuth 2.0 Credentials record can retrieve a token using Get OAuth Token.
* Confirm the connector appears under Established connections on the Control Enforcement Points tab.

To deploy the AI agent, see [Create and deploy an agent with Agent CLI and Agent Identity](https://docs.cloud.google.com/iam/docs/create-and-deploy-agent) in Google documentation.

*[\>]: and then