---
season: 3
season_name: "Season 3 — October 2026 (Autumn / Halloween Edition)"
day: 27
title: "Data Boundaries: Enforcing VPC-SC, CMEK & Data Residency"
summary: "Keep agents strictly within the perimeter and satisfy compliance."
tags: ["Phase 5: Secure Perimeter", "Encryption", "Compliance", "Agent Security"]
canonical_url: "https://adventofagents.com/2026/10/27"
markdown_url: "https://adventofagents.com/2026/10/27.md"
video_url: "https://www.youtube.com/embed/HkTv2uQfy0Q"
primary_video:
  title: "Day 27: Data Boundaries: Enforcing VPC-SC, CMEK & Data Residency"
  creator_name: "Catherine Vu & Anirudh Kannan"
  duration: "15:00"
  video_url: "https://www.youtube.com/embed/HkTv2uQfy0Q"
---

# 🏰 Day 27: Data Boundaries: Enforcing VPC-SC, CMEK & Data Residency

> **Season 3 — October 2026 (Autumn / Halloween Edition)** · [Interactive Web View](https://adventofagents.com/2026/10/27?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day27) · [Raw Markdown](https://adventofagents.com/2026/10/27.md?utm_source=adventofagents&utm_medium=markdown&utm_campaign=adventofagents_s3_2026&utm_content=day27)

**Summary:** Keep agents strictly within the perimeter and satisfy compliance.

**Day 27 of Google's Advent of Agents — Season 3**

Giving every agent a cryptographic SPIFFE identity, routing tool calls through Agent Gateway, and screening prompts with Model Armor secures who your agent is and what it executes. Before shipping to production in regulated industries, security and compliance teams ask one critical question: how do we guarantee that sensitive data never leaves our approved boundary, never traverses the public internet, and remains encrypted with keys we control in our required geographic region?

**How It Works**

Google Cloud enforces defense-in-depth data boundaries around autonomous agents at the infrastructure and control-plane layers, independent of model behavior or prompt instructions:

![Data Boundaries Architecture](/s03/day27-data-boundaries.png)

- **Customer-Managed Encryption Keys (CMEK) and Regional Parity**: Instead of default Google-managed keys, Cloud KMS lets your security team own the symmetric encryption keys protecting Cloud Storage buckets, BigQuery tables, and Gemini platform resources. Because CMEK requires exact regional alignment between the key and the resource (for example, `us-central1`), you cannot bind CMEK to a `global` endpoint, and disabling a key version acts as an instant cryptographic kill-switch.
- **Organization Policies for Data Residency**: Project-level Organization Policies mechanically enforce where resources are provisioned (`constraints/gcp.resourceLocations`), restrict model inference endpoints strictly to approved regions (`constraints/gcp.restrictEndpointUsage`), mandate CMEK encryption on new storage and AI services (`constraints/gcp.restrictNonCmekServices`), and disable downloadable service account keys (`constraints/iam.disableServiceAccountKeyCreation`).
- **Access Context Manager and VPC Service Controls (VPC-SC)**: Starting with an Access Context Manager access level so administrators are not locked out, a VPC-SC service perimeter seals Gemini platform, Cloud Storage, and Cloud KMS inside a project boundary with zero egress rules. Even if an agent is prompt-injected or wired to a malicious tool, attempts to copy files to an external project bucket or POST data to the public internet are blocked at the control plane.
- **Private Service Connect (PSC) and Assured Workloads**: Inside a VPC-SC perimeter, Agent Runtime operates on a restricted network (`restricted.googleapis.com`) with no public internet routes and uses Private Service Connect as a private one-way bridge to reach on-premises or cross-VPC databases. For teams starting new regulated workloads (HIPAA, FedRAMP, IL2/4/5, ITAR, or Sovereign Controls), Assured Workloads provisions a compliant folder pre-configured with these baseline residency, CMEK, and personnel support guardrails out of the box.

**Resources:**

- [Day 27 Companion GitHub Repository](https://g.dev/cloud/adventofagents-season3-day27-demo)
- [VPC Service Controls Overview](https://g.dev/cloud/adventofagents-season3-docs-vpc-service-controls)
- [Customer-Managed Encryption Keys (CMEK)](https://g.dev/cloud/adventofagents-season3-docs-cmek)
- [Assured Workloads Documentation](https://g.dev/cloud/adventofagents-season3-docs-assured-workloads)

## Code & Commands

### Enforce Preventative Organization Policies (Data Residency, CMEK & Keyless Auth)

```bash
export CLOUDSDK_METRICS_ENVIRONMENT="advent-of-agents-s3-day27"

# 1. Lock stateful resource creation across all GCP services strictly to US locations
gcloud resource-manager org-policies allow gcp.resourceLocations \
  in:us-locations \
  --project="${PROJECT_ID}"

# 2. Block all non-US and global Gemini platform endpoints so stateless LLM inference stays in the US
#    (Technical group ID uses the 'aiplatform' prefix; add in:global-<service>-endpoints as needed)
gcloud resource-manager org-policies deny gcp.restrictEndpointUsage \
  in:non-us-aiplatform-endpoints \
  --project="${PROJECT_ID}"

# 3. Require CMEK on newly created Gemini platform resources
#    (For production, append any data stores your agent uses—e.g. storage.googleapis.com,
#     bigquery.googleapis.com)
gcloud resource-manager org-policies deny gcp.restrictNonCmekServices \
  aiplatform.googleapis.com \
  --project="${PROJECT_ID}"

# 4. Block downloadable service account keys (require keyless SPIFFE / Workload Identity)
gcloud resource-manager org-policies enable-enforce \
  iam.disableServiceAccountKeyCreation \
  --project="${PROJECT_ID}"
```

## Resources & Links

- **[Day 27 Companion GitHub Repository](https://g.dev/cloud/adventofagents-season3-day27-demo)** — Full CLI scripts, Organization Policy YAML manifests, and demo prompts for setting up agent data boundaries.
- **[VPC Service Controls Documentation](https://g.dev/cloud/adventofagents-season3-docs-vpc-service-controls)** — Configure service perimeters and Private Service Connect to prevent data exfiltration.
- **[Customer-Managed Encryption Keys (CMEK)](https://g.dev/cloud/adventofagents-season3-docs-cmek)** — Create, rotate, and manage encryption keys in Cloud KMS to maintain cryptographic custody.
- **[Assured Workloads Overview](https://g.dev/cloud/adventofagents-season3-docs-assured-workloads)** — Automate folder-level compliance guardrails for HIPAA, FedRAMP, ITAR, and sovereign workloads.