Gemini Enterprise Integration with Joule Agents

Disclaimer

Some components and capabilities of this reference architecture are not yet generally available (GA) — the current architecture reflects a transitional state that highlights the relevant building blocks for an agentic architecture based on SAP Business AI Platform. In particular, the Agent Gateway is not yet GA. The pattern outlined here shows how the integration between Google Gemini Enterprise and SAP can be done today and will evolve as those capabilities are released.

Google Gemini Enterprise and the GCP Agent Platform let organizations build and orchestrate AI agents across Google Cloud and the Google Workspace surface. This page describes the inbound direction — a Gemini Enterprise agent consuming agents running on SAP Business AI Platform. The SAP side, running on SAP Business AI Platform, exposes Joule Agents, Assistants, and Custom Agents (built with Joule Studio) through the Agent Gateway. Identity flows end-to-end through SAP Cloud Identity Services, so every delegated task runs in the context of the signed-in business user and respects existing SAP authorizations.

A user working in Gemini Enterprise can hand an SAP-specific task to a Joule Agent, Assistant, or Custom Agent and receives the answer in the flow of work. Because every delegation runs under the signed-in user's identity, the SAP authorizations already in place in the downstream system continue to govern what the agent can do, with full end-to-end traceability.

Architecture

Solution Diagram Resources

You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.

Download

Edit

Gemini Enterprise cannot connect directly to an SAP agent through SAP Agent Gateway because it does not support cross-provider A2A authentication with an in-product sign-in prompt. The integration therefore uses a proxy agent on Google Agent Runtime (Vertex AI Agent Engine) as the bridge: Gemini Enterprise delegates tasks to the proxy, which handles the cross-provider authentication with SAP and relays the call to the Agent Gateway.

The proxy agent has a single job: take the end-user token that Gemini Enterprise forwards, exchange it at SAP Cloud Identity Services (IAS) for a token scoped to the Agent Gateway, and relay the call to the agent running on SAP Business AI Platform. Because the proxy is itself a Gemini Enterprise agent, it initiates the three-legged OAuth flow and can surface the SAP sign-in prompt in the Gemini Enterprise chat UI, which is what makes the three-legged OAuth / front-channel flow possible.

Core Components

Gemini Enterprise / GCP Agent Platform: The orchestrator the user interacts with. Forwards the end-user token and renders the SAP sign-in prompt.
Proxy Agent (Google Agent Runtime / Vertex AI Agent Engine): Transparent proxy that exchanges the user token at SAP IAS for an Agent-Gateway-scoped token and relays the call downstream.
SAP Cloud Identity Services: Authenticates the user via the three-legged OAuth / front-channel flow and mints the downstream-scoped token; brokers the identity into SAP.
Agent Gateway: The single inbound hub for agent traffic on the SAP side. Routes to the SAP-managed runtimes where the Joule Agents, Assistants, and Custom Agents are deployed.

Identity and principal propagation

Secure, user-context-aware access is the centerpiece of this architecture — the goal is no shared secrets and no over-privileged service accounts, so each agent running on SAP Business AI Platform invocation executes with the permissions of the individual signed-in user.

The flow is three-legged OAuth: Gemini Enterprise authenticates the end user against SAP Cloud Identity Services over the front channel (a browser redirect / in-product sign-in prompt, rendered through the proxy agent), and forwards the resulting user token.
The Agent Gateway only accepts a token minted specifically for the agent-gateway resource (urn:sap:identity:application:provider:name:agent-gateway) — a plain OAuth bearer token does not carry the audience the gateway requires. The proxy agent performs this token exchange at SAP IAS.
To authenticate the exchange, the proxy signs a client assertion using a dedicated Google Cloud service account whose public keys SAP IAS trusts (configured as a trusted JWT issuer). No long-lived client secret is stored in the runtime.
Because the user's identity is preserved through to the SAP side, the target agent's role-based access control (RBAC) is enforced per real user, and actions are attributable to a named user for audit and compliance.

Integration approach

Reaching an agent running on SAP Business AI Platform behind the Agent Gateway from Gemini Enterprise comes down to three pieces of setup:

A Google Cloud service account that signs the SAP IAS client assertion — SAP IAS is configured to trust this service account as a JWT issuer, so no client secret needs to be stored in the Google runtime. This also eliminates secret rotation, as the service account is managed by Google Cloud.
An SAP IAS application configured with the Gemini Enterprise redirect URIs and a trust relationship to the Google service account, so it can run the three-legged OAuth flow and mint the Agent-Gateway-scoped token.
The proxy agent on Google Agent Runtime, pointed at the downstream Agent Gateway A2A endpoint, that performs the token exchange and relays the call. It is then registered in Gemini Enterprise so users can delegate to it.

Agent Interoperability Cookbook for Integrating Joule Agents into Google's Gemini Enterprise

Step-by-step setup — service-account signer, SAP Cloud Identity Services trust and redirect configuration, proxy-agent deployment, and Gemini Enterprise registration — lives in the cookbook: GCP Integration - Gemini Enterprise in SAP-samples/agent-interoperability.