Google Patents a Security Gate for AI Systems That Call Outside Tools
AI assistants that can browse the web, run code, and call third-party apps are only as trustworthy as the guardrails around what data they hand off. Google's new patent describes a system that checks data-privacy rules before every single action an AI agent takes.
How Google's AI agent security policy check works
You're using an AI assistant to help manage your work email, and you've connected it to your calendar, your HR system, and a third-party scheduling app. At some point the assistant needs to pass information from one tool to another to get the job done. The problem: nothing is automatically checking whether handing your salary data to the scheduling app is actually allowed.
Google's patent describes a system that fixes that. Before the AI assistant calls any connected app or tool, it checks a set of data security policies that say what information is allowed to flow where. Each piece of data carries a record of where it came from, and the system checks that record against the rules before handing anything over.
If the rules say your HR data can't go to a third-party app, the action simply doesn't happen. The AI still tries to complete your request, but it's blocked from violating the policy, even if you never thought to ask it to be careful.
… processing an input that comprises the query using a planner generative neural network to generate a planner output that specifies a planned sequence of actions for generating a response to the query …
Translation: An AI planner maps out a step-by-step plan to answer a user's question.
Inside Google's per-variable dependency-policy engine
The patent describes an AI agent system with two main parts working together: a planner model and a policy enforcement layer.
The planner model (a large language model used here as a reasoning engine) takes your query and produces a step-by-step plan. That plan is a sequence of actions, where each action is a call to a specific software tool, like a web search API, a database, or a code executor, along with the variables (pieces of data) that call needs as input.
Before any tool is actually called, the system generates dependency data for every variable in the plan. Dependency data is essentially a provenance record: it tracks where each piece of data originally came from and what tools have already touched it. Think of it like a chain of custody for information.
When it's time to execute a tool call, the system:
- Identifies the current value of each variable the tool needs
- Looks up that variable's dependency record
- Checks all security policies that apply to that specific tool against both the values and their histories
- Only hands the data to the tool if every applicable policy is satisfied
This means a policy like "never send data originating from the HR database to an external API" is enforced automatically, at runtime, without requiring the user or the AI to remember the rule.
… data security policies are used to improve data security when performing tasks using the generative neural network(s).
Translation: Security rules protect user data while the AI carries out its tasks.
What this means for AI assistants handling your private data
For anyone using an AI assistant connected to real accounts and real data, this kind of system matters a lot. The current generation of AI agents that can call tools are powerful precisely because they chain actions together, but that chaining is also how a single misconfigured step can expose sensitive information to the wrong destination. A per-variable, policy-checked approach would let organizations deploy AI agents without having to audit every possible action path by hand.
The practical path to a product here is relatively short: this is a software architecture, not a new chip or sensor, so it could in principle be layered onto existing AI agent frameworks. Google already operates agent-style products, and the main prerequisite is a maintained policy store and the planner model described in the filing. The new Big Tech patents covering AI agent security are coming fast as every major platform races to make tool-calling agents safe enough for enterprise use, and this filing sits squarely in that sprint.
Google's 19th filing we've tracked since May in our AI guardrails race watchlist adds to a pattern that includes one checking code before it runs and one citing sources in summaries.
This invention needs no new hardware. It runs entirely on software that big AI companies already have up and running, so turning this patent into a real product is a much shorter journey than usual.
The main work ahead is not technical. Someone has to write the rules the system enforces, and then keep those rules updated over time. That is a people and policy problem, not an engineering one.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
7 drawing sheets from US 2026/0244783 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →