Google ADK for Go 2.6

Apply the Go 1.27 baseline first. These rules target the google.golang.org/adk/v2 2.6 release line, checked against v2.6.0. Its go.mod declares Go 1.26.6; review the deployed toolchain separately from the module.

Agent and instruction boundaries

• Construct llmagent.Config models, instructions, generation settings, tools, toolsets, and subagents from trusted configuration. Treat user, document, memory, tool, skill, and remote-agent content as data; prompt injection in any of it must not become trusted instruction or authorization.
• Keep untrusted session state and artifact text out of authoritative Instruction and GlobalInstruction templates: {key} and {artifact.name} insert their contents. Use InstructionProvider for literal braces and validate any values the provider inserts.
• Put shared instructions on the root agent, whose GlobalInstruction takes effect. Review instruction providers that override static instructions, and enforce access policy in handlers instead of relying on model obedience.
• Minimize Tools, Toolsets, and SubAgents; set DisallowTransferToParent and DisallowTransferToPeers when routing is unnecessary. Recheck the receiving agent's principal and resource permissions after any transfer.
• Validate OutputSchema and OutputKey values before output handling in HTML, queries, commands, storage, or external actions. OutputSchema still permits tool calls through set_model_response; neither its shape nor stored model output grants authority.

Tool calls and human input

• Define bounded argument and result schemas