---
season: 3
season_name: "Season 3 — October 2026 (Autumn / Halloween Edition)"
day: 21
title: "Governance Archetypes: Central Hub vs. Federated Mesh"
summary: "Architect multi-project agent governance across lines of business using centralized hub-and-spoke gateways, federated regional registries, and two-tier SPIFFE access policies."
tags: ["Agent Registry", "Agent Gateway", "Governance", "Zero Trust"]
canonical_url: "https://adventofagents.com/2026/10/21"
markdown_url: "https://adventofagents.com/2026/10/21.md"
video_url: "https://www.youtube.com/embed/pA5KnXxPsHM"
primary_video:
  title: "Day 21: Enterprise Governance Archetypes (Centralized vs. Federated) — 5-Minute Google Cloud Kata"
  creator_name: "Google Cloud Engineering"
  duration: "5:18"
  video_url: "https://www.youtube.com/embed/pA5KnXxPsHM"
---

# 🏛️ Day 21: Governance Archetypes: Central Hub vs. Federated Mesh

> **Season 3 — October 2026 (Autumn / Halloween Edition)** · [Interactive Web View](https://adventofagents.com/2026/10/21?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21) · [Raw Markdown](https://adventofagents.com/2026/10/21.md?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)

**Summary:** Architect multi-project agent governance across lines of business using centralized hub-and-spoke gateways, federated regional registries, and two-tier SPIFFE access policies.

**Day 21 of Google's Advent of Agents — Season 3**

Governing three agents inside a single Google Cloud project is straightforward, but scaling to hundreds of agents across dozens of lines of business (LOBs) and regulatory regions quickly exposes architectural fault lines. Platform and security leaders must decide whether to build a single central governance hub, federate registries per business unit, or combine both without creating compliance blind spots or developer bottlenecks.

**How It Works**

Enterprise platform teams balance security oversight, organizational velocity, and regional data residency using three governance archetypes and a two-tier identity policy:

- **Archetype A (Single Central Governance Hub)**: A dedicated `PROJECT_GOVERNANCE` management project hosts one central **Agent Registry** and **Agent Gateway** (`AGENT_TO_ANYWHERE`), while spoke runtime projects route egress through the hub for unified SecOps visibility and an organization-wide kill switch.
- **Archetype B (Federated per LOB or Region)**: Autonomous business units or sovereign regions (`us-central1` vs. `europe-west1`) operate local registries and gateways to satisfy regional alignment constraints and prevent cross-LOB metadata leakage, governed from above by organization-wide **Model Armor Floor Settings**.
- **Archetype C (Hybrid Hub-of-Hubs)**: Domain teams curate and approve agents locally inside LOB spoke registries while a central governance hub aggregates cross-enterprise inventory and governs shared Tier-0 MCP servers.
- **Two-Tier SPIFFE Identity Scoping**: Cross-project Unified Access Policies combine coarse-grained `principalSet://` rules (granting spoke project workloads baseline access to core Google APIs) with fine-grained `principal://` rules and CEL conditions (`destination.is_registered == true`) for zero-trust tool and A2A invocation.

**Resources:**

- [Demo Repository](https://github.com/arobinson12/advent-of-agents-s3-day21-governance-archetypes?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)
- [Codelab: Agent Gateway Centralized Governance with Cross-Project Agent Registry](https://codelabs.developers.google.com/agw-multiproject?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)
- [Agent Registry Overview](https://docs.cloud.google.com/agent-registry/overview?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)
- [Google Cloud Secure AI Framework (SAIF)](https://safety.google/cybersecurity-advancements/saif/)

## Code & Commands

```python
"""Day 21: Enterprise Governance Archetype Advisor & Multi-Project Policy Generator."""

from dataclasses import dataclass
import json
from typing import List


@dataclass
class EnterpriseTopology:
    org_id: str
    governance_project_id: str
    spoke_project_numbers: List[str]
    regions: List[str]
    autonomous_lobs: bool
    shared_crown_jewel_tools: bool


def recommend_archetype(topology: EnterpriseTopology) -> dict:
    """Evaluate organizational constraints to select the optimal governance archetype."""
    multi_region = len(set(topology.regions)) > 1

    if multi_region and topology.shared_crown_jewel_tools:
        archetype = "Archetype C: Hybrid Hub-of-Hubs (Regional/LOB Hubs + Central Shared Services)"
        rationale = (
            "Agent Gateway, Agent Registry, and Gemini Enterprise require regional alignment "
            f"({', '.join(topology.regions)}). Deploy regional hubs per residency zone while "
            "governing shared enterprise MCP servers in a central security project."
        )
    elif multi_region or topology.autonomous_lobs:
        archetype = "Archetype B: Federated by Line of Business / Region"
        rationale = (
            "Autonomous business units or multi-region boundaries benefit from local Agent "
            "Registries paired with Org-level Model Armor Floor Settings and Principal Access Boundaries."
        )
    else:
        archetype = "Archetype A: Centralized Hub-and-Spoke"
        rationale = (
            "Single-region footprint with unified SecOps oversight. Route all spoke project "
            "Reasoning Engines through a single Central Agent Gateway and Central Agent Registry."
        )

    return {"recommended_archetype": archetype, "rationale": rationale}


def generate_two_tier_hub_policy(
    org_id: str,
    spoke_project_number: str,
    concierge_engine_id: str,
    sellers_mcp_sa: str,
    region: str = "us-central1",
) -> dict:
    """Generate a Two-Tier Cross-Project Unified Access Policy for a Central Agent Gateway."""
    base_hosts = [
        "aiplatform.googleapis.com",
        f"{region}-aiplatform.googleapis.com",
        "telemetry.googleapis.com",
        "logging.googleapis.com",
        "monitoring.googleapis.com",
    ]
    core_gapi_hosts = []
    for host in base_hosts:
        mtls_host = host.replace(".googleapis.com", ".mtls.googleapis.com")
        core_gapi_hosts.extend([host, f"{host}:443", mtls_host, f"{mtls_host}:443"])

    # Tier 1: Coarse-grained project-level principalSet for baseline Google APIs
    spoke_project_principal_set = (
        f"principalSet://agents.global.org-{org_id}.system.id.goog/"
        f"attribute.platformContainer/aiplatform/projects/{spoke_project_number}"
    )

    # Tier 2: Fine-grained workload principal for specific cross-project A2A / MCP access
    concierge_agent_principal = (
        f"principal://agents.global.org-{org_id}.system.id.goog/"
        f"resources/aiplatform/projects/{spoke_project_number}/locations/{region}/"
        f"reasoningEngines/{concierge_engine_id}"
    )

    return {
        "destination_groups": {
            "core-gapi-services": {"hosts": core_gapi_hosts},
            "any-destination": {"hosts": ["*"]},
        },
        "access_control_policies": [
            {
                "name": "tier1-allow-spoke-core-gapi",
                "destinations": ["core-gapi-services"],
                "rules": [
                    {
                        "principals": [spoke_project_principal_set],
                        "verdict": "allow",
                        "permissions": ["iap.googleapis.com/resources.egressViaIAP"],
                    }
                ],
            },
            {
                "name": "tier2-allow-registered-cross-project-mcp",
                "destinations": ["any-destination"],
                "rules": [
                    {
                        "principals": [concierge_agent_principal],
                        "verdict": "allow",
                        "permissions": ["iap.googleapis.com/resources.egressViaIAP"],
                        "condition": {
                            "title": "AllowVerifiedCentralRegistryMcpServer",
                            "expression": (
                                "destination.is_registered == true && "
                                "destination.agent_registry.resource_type == 'MCP_SERVER' && "
                                "destination.agent_registry.attributes["
                                "'agentregistry.googleapis.com/system/RuntimeIdentity'"
                                f"].principal == 'serviceAccount:{sellers_mcp_sa}'"
                            ),
                        },
                    }
                ],
            },
        ],
    }


if __name__ == "__main__":
    topo = EnterpriseTopology(
        org_id="123456789012",
        governance_project_id="omnicorp-governance-hub",
        spoke_project_numbers=["111111111111", "222222222222"],
        regions=["us-central1", "europe-west1"],
        autonomous_lobs=True,
        shared_crown_jewel_tools=True,
    )
    decision = recommend_archetype(topo)
    print(f"=== Recommended Strategy ===\n{decision['recommended_archetype']}")
    print(f"Why: {decision['rationale']}\n")

    uap = generate_two_tier_hub_policy(
        org_id=topo.org_id,
        spoke_project_number=topo.spoke_project_numbers[0],
        concierge_engine_id="9876543210",
        sellers_mcp_sa="mcp-runtime@omnicorp-sellers-spoke.iam.gserviceaccount.com",
    )
    with open("central_hub_uap.json", "w", encoding="utf-8") as f:
        json.dump(uap, f, indent=2)
    print("Generated central_hub_uap.json with Two-Tier SPIFFE Identity Scoping.")
```

```bash
#!/usr/bin/env bash
set -euo pipefail

# Day 21: Cross-Project Enterprise Governance Archetypes Setup
export CLOUDSDK_METRICS_ENVIRONMENT="advent-of-agents-s3-day21"

export PROJECT_GOVERNANCE="${PROJECT_GOVERNANCE:-omnicorp-governance-hub}"
export PROJECT_CONCIERGE="${PROJECT_CONCIERGE:-omnicorp-concierge-spoke}"
export REGION="${GOOGLE_CLOUD_LOCATION:-us-central1}"
export GATEWAY_NAME="central-enterprise-agw"

echo "=== 1. Generate the Two-Tier Unified Access Policy (central_hub_uap.json) ==="
python3 governance_archetype_advisor.py

echo "=== 2. Create the Central Agent Gateway in PROJECT_GOVERNANCE ==="
gcloud alpha network-security agent-gateways create "${GATEWAY_NAME}" \
  --project="${PROJECT_GOVERNANCE}" \
  --location="${REGION}" \
  --protocols=MCP \
  --forward-proxy-mode=AGENT_TO_ANYWHERE \
  --registry="projects/${PROJECT_GOVERNANCE}/locations/${REGION}" \
  --async || echo "Central gateway already exists."

echo "=== 3. Grant Spoke Project Reasoning Engine Service Agent Attachment Rights ==="
SPOKE_NUMBER="$(gcloud projects describe "${PROJECT_CONCIERGE}" --format='value(projectNumber)')"
SPOKE_RE_SA="service-${SPOKE_NUMBER}@gcp-sa-aiplatform-re.iam.gserviceaccount.com"

gcloud alpha network-security agent-gateways add-iam-policy-binding "${GATEWAY_NAME}" \
  --project="${PROJECT_GOVERNANCE}" \
  --location="${REGION}" \
  --member="serviceAccount:${SPOKE_RE_SA}" \
  --role="roles/networksecurity.agentGatewayUser"

echo "=== 4. Inspect the Two-Tier Unified Access Policy Rules ==="
cat central_hub_uap.json | jq '.access_control_policies[] | {name: .name, rules: .rules}'
```

## Resources & Links

- **[Day 21 Code Kata](https://github.com/arobinson12/advent-of-agents-s3-day21-governance-archetypes?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)** — Interactive simulator and Argolis deployment for all 3 governance archetypes.
- **[Codelab: Multi-Project Agent Gateway & Registry](https://codelabs.developers.google.com/agw-multiproject?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)** — Wire spoke Reasoning Engines to a central Agent Gateway and Agent Registry.
- **[Agent Registry Overview](https://docs.cloud.google.com/agent-registry/overview?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day21)** — Centralized discovery and governance for agents, MCP servers, and tools.
- **[Google Cloud Secure AI Framework (SAIF)](https://safety.google/cybersecurity-advancements/saif/)** — Enterprise security controls and governance blueprint for AI systems.