Google ADK for Python 2.8

Apply the Python 3 baseline first. These rules cover Google ADK for Python 2.8 agents, tools, callbacks, plugins, sessions, memory, artifacts, multi-agent transfer, evaluation, and deployment.

Agent definitions and instructions

• Construct agent names, models, instructions, planners, and generation settings from trusted application configuration.
• Keep untrusted user, retrieved, memory, and tool content separate from authoritative agent instructions.
• Give each agent only the tools and subagents required for its role.
• Bound agent turns, model calls, tokens, wall time, retries, and transfer depth for each invocation.
• Treat every final response and generated plan as untrusted until the consuming system validates it.

Tools and function execution

• Define narrow tool schemas and validate arguments independently before the tool runs.
• Map function calls to a fixed trusted registry and never resolve arbitrary callables from model-produced names.
• Reauthorize every tool call against current user, tenant, resource, and operation context.
• Require explicit approval for external, irreversible, privileged, costly, or destructive actions.
• Keep confidential OAuth client secrets out of ADK 2.8's interactive adk_request_credential flow; it can serialize them into client-visible events and session history, so handle that exchange in a trusted backend.
• Restrict built-in, Google Cloud, OpenAPI, and MCP tools to allowlisted services, operations, and destinations.
• For MCP HTTP endpoints outside Google APIs, set GOOGLE_API_USE_CLIENT_CERTIFICATE=false before