Google ADK for Go 2.3.0

Apply the Go 1.27 baseline first. These rules target google.golang.org/adk/v2 v2.3.0 on Go 1.27; the module requires Go 1.26.6 or newer.

Agent configuration and instruction boundaries

• Build llmagent.Config models, instructions, tools, toolsets, subagents, and generation settings from trusted configuration; treat tool descriptions and retrieved content as untrusted inputs to model decisions.
• Keep untrusted state and artifact text out of authoritative Instruction and GlobalInstruction templates: {key} and {artifact.name} substitute their contents. Use InstructionProvider for literal braces, and validate any values the provider inserts.
• Put shared instructions on the root agent; only its GlobalInstruction takes effect. Review instruction providers because they override the corresponding static instructions, and keep authorization independent of all instruction text.
• Minimize Tools, Toolsets, and SubAgents, and set DisallowTransferToParent and DisallowTransferToPeers when those routes are unnecessary; transfer restrictions do not authorize access to the destination's resources.
• Validate structured agent output before using it for privileged operations; OutputSchema still permits tool calls through set_model_response, and OutputKey stores model-produced data rather than trusted policy.

Tool execution and callback coverage

• Use typed functiontool.New arguments and explicit schema bounds, then check business constraints and current principal, tenant, resource, and operation inside the handler; schema validation does not grant