Google Agent Development Kit for Java 1.13

Apply these rules to Java ADK agents, tools, runners, sessions, workflows, and exposed services. Treat model output, retrieved content, skills, MCP results, A2A peers, and persisted state as untrusted input to the next step.

Instructions and agent construction

• Keep trusted LlmAgent instructions and tool policy in reviewed code. Treat values interpolated from state or artifacts into instructions as data; never let those values rewrite roles, tool permissions, or system policy.
• Accept agent configuration, class names, tool definitions, and local skill directories only from trusted deployment sources. Review ConfigAgentUtils and tool resolution before loading configuration supplied outside the agent's directory; a warning is not a containment boundary.
• Restrict LocalSkillSource to a trusted, non-writable tree. Check resolved skill and resource paths, including symlinks, against the approved root before reading; its lexical normalization does not establish real-path containment.
• Register only the tools an agent needs, with narrow descriptions and input schemas. Treat LlmAgent transfer targets and sub-agent descriptions as capabilities exposed to the model; disable parent or peer transfers where the workflow does not require them.
• Review dynamic LlmAgent instructions and includeContents settings before sending session history, memory, or artifacts to a model; include only content the current principal may disclose.

Tool authorization and confirmation

• In every FunctionTool or other effectful BaseTool, authorize the current principal,