Secure Web Proxy overview

Secure Web Proxy helps secure your outbound agentic traffic and standard web traffic—HTTP and HTTPS—from your organization's internal network. When you configure your AI agents and non-agentic workloads to use Secure Web Proxy as a gateway, the proxy acts as a mandatory security checkpoint for any application or service that tries to access a website outside your organization.

Benefits

Secure Web Proxy provides the following key benefits:

• Outbound traffic governance of AI agents. When integrated with Agent Gateway, Secure Web Proxy enforces centralized security policies for agent to tool, endpoint, or model access. You can enforce granular security perimeters, cryptographically verify agent identities, inspect Model Context Protocol (MCP) tool calls, and apply Model Armor content sanitization guardrails to outgoing agent traffic.

• Identity-aware access control. Access is based on cryptographic workload and agentic identities, rather than static network locations:

  • Agentic identities: for autonomous AI agents, you can verify agent identities by integrating with Identity and Access Management (IAM) and Identity-Aware Proxy (IAP) through Service Extensions extension bindings.

  • Workload identities: for non-agentic workloads, you can verify source identities by using service accounts, secure tags, or client certificates with frontend mutual TLS (mTLS).

  This identity-centric model enables fine-grained authorization rules that help restrict outbound web traffic to authenticated workloads and agents.

• Strong default security. Secure Web Proxy has a default deny-all setting that blocks all outbound traffic until you explicitly allow it. Google Cloud automatically manages all software and infrastructure updates, which minimizes the ongoing risk of security vulnerabilities.

• Centralized inspection. Secure Web Proxy consolidates outbound web requests from your cloud workloads and connected offices into a single inspection point for consistent policy enforcement.

• Comprehensive observability and tracing. All outbound traffic is centrally logged in Cloud Logging and integrated with Cloud Trace and OpenTelemetry. This integration provides complete auditability, incident investigation, and end-to-end latency analysis.

Supported features

Secure Web Proxy supports the following features:

• Granular outbound access policies: you can enforce targeted security controls based on your traffic type:

  • Agentic AI traffic: when deployed as an Agent Gateway, Secure Web Proxy evaluates MCP method rules, verifies agent identities, and invokes extension bindings in Service Extensions to sanitize prompts and responses with services such as Model Armor.
  • Standard web traffic: for standard web traffic, Secure Web Proxy evaluates gateway security policies or authorization policies to identify source workloads by using secure tags, service accounts, or frontend mTLS certificates. The proxy also filters destination hostnames, URLs, headers, and methods.

  This granular feature of policies lets you create and manage specific, reusable rule components across multiple Secure Web Proxy instances.

• Autoscaling Secure Web Proxy Envoy proxies: Secure Web Proxy supports automatically adjusting the Envoy proxy pool size and the pool's capacity in a region, which enables consistent performance during high-demand periods at the lowest cost. The autoscaling feature automatically manages capacity adjustments in a region. This means that you don't have to manually monitor and resize your proxy fleet, ensuring better performance with less operational time.

• Service rate limiting: Secure Web Proxy enforces traffic limits on outbound web traffic to prevent resource-intensive clients from exhausting service capacity or generating excessive costs, such as those associated with large language model (LLM) tokens. You can attach service rate limiting policies to gateways that are configured with either gateway security policies or authorization policies. You can use rate limiting policies to prioritize or throttle traffic based on request counts and specific client identities, such as mTLS principals or source IP addresses.

• End-to-end encryption: client-proxy tunnels can transit over TLS. Secure Web Proxy also supports HTTP and HTTPS CONNECT for client-initiated, end-to-end TLS connections to the destination server. This crucial security measure is automatically managed by the service so that traffic is secured without requiring the manual configuration or monitoring of encryption standards.

• Cloud Audit Logs and Google Cloud Observability integration: by using Google Cloud Observability, Cloud Audit Logs records both administrative actions (policy changes) and access requests and metrics (proxy transaction logs) for Secure Web Proxy. This unified, built-in view facilitates security monitoring and compliance reporting.

How Secure Web Proxy works

Secure Web Proxy acts as a mandatory security checkpoint for all web traffic from your organization's network to the internet. Internal workloads must comply with Secure Web Proxy security rules before they can reach the internet.

1. Centralized gateway: your workloads, such as virtual machines (VMs) and containers, are configured to send all outbound web requests to the central Secure Web Proxy instance.

2. Policy enforcement: the proxy inspects the request and applies your security policies to determine whether to allow or deny the connection.

3. Secure outbound traffic: if the request is allowed, then the traffic is securely routed out to the internet by using the Google Cloud infrastructure, typically Cloud NAT. The proxy also uses Cloud DNS to resolve external web addresses.

Policies and rules

To secure outbound traffic, choose either an authorization policy or a gateway security policy as your primary security mechanism on your Secure Web Proxy instance. You can configure only one primary policy model on a single gateway. In addition, you can optionally configure service rate limiting policies on top of either primary policy choice.

• Authorization policies: these policies let you establish identity-based and destination-based access control checks when processing outbound requests through your Secure Web Proxy instance. We recommend using this policy type for the following scenarios:

  • When you deploy Secure Web Proxy as an Agent Gateway to govern agentic traffic.
  • When you deploy Secure Web Proxy for non-agentic traffic that requires frontend mTLS to verify source identities or custom authorization extensions.

• Gateway security policies and rules: these policies and rules define access controls for standard, non-agentic outbound web traffic. A gateway security policy serves as the container for individual security rules that allow or deny traffic based on source identities (service accounts or secure tags), destination hostnames, and ports.

• Service rate limiting policies: these policies let you enforce client-specific and service-wide request rate limits on outbound web traffic to protect external destinations from traffic overloads and control costs. You can attach a service rate limiting policy to a gateway that uses either an authorization policy or a gateway security policy.

Agent Gateway integration with Secure Web Proxy

Enterprise AI workloads deployed across Google Cloud—including Software as a Service (SaaS) solutions such as Gemini Enterprise, Platform as a Service (PaaS) environments such as Vertex AI Agent Engine, and containerized or self-hosted runtimes on Google Kubernetes Engine (GKE) and Cloud Run—require robust, centralized network boundaries to enforce data privacy, compliance policies, and threat prevention.

Agent Gateway provides centralized policy management, cryptographic identity verification, and security guardrails for AI agents. For agents that run on either GKE or Cloud Run, you can deploy a Secure Web Proxy instance as an Agent Gateway. This setup lets you enforce centralized security policies for outbound traffic to LLMs, MCP tools, external APIs, remote agents, or standard web destinations.

Using a Secure Web Proxy instance with an agentGateway resource provides the following benefits:

• Centralized policy governance: apply authorization policies that are defined on an agentGateway resource to your Secure Web Proxy instance. This feature lets you create a unified security posture across multiple agent environments.

• Agent identity and mTLS: use client certificate validation and authorization policies to cryptographically verify and restrict outbound communications based on the agent's identity.

• MCP tool restriction: enforce granular HTTP rules on agent interactions with external MCP tool servers, restricting specific tool methods (such as tools/list or tools/call) and method parameters.

• Payload verification and sanitization: integrate directly with Model Armor by using extension bindings in Service Extensions to inspect prompts and agent responses for sensitive data leaks or prompt injection attacks.

Deployment modes

You can deploy your Secure Web Proxy instance in any one of the following modes:

• Explicit proxy routing mode: in this mode, you must explicitly configure your workload environments and clients to point directly to the proxy server. Secure Web Proxy then isolates your clients from the internet. In this way, Secure Web Proxy acts as an intermediary, establishing new TCP connections for the client and ensuring that every connection meets the requirements of the administered security policy.

• Private Service Connect service attachment mode: in this mode, you can centralize your web proxy deployments across a complex, multi-Virtual Private Cloud (VPC) architecture.

• Next hop mode: in this mode, you can configure your Secure Web Proxy instance to act as a next hop for the routing in your network. In other words, you can configure your network routing to automatically send outbound traffic to your Secure Web Proxy instance. This deployment method reduces your organization's administrative overhead because you don't have to manually configure each source workload or client to use the proxy.

Limitations

• IP versions: Secure Web Proxy supports only IPv4; IPv6 isn't supported.

• HTTP versions: Secure Web Proxy supports HTTP/0.9, 1.0, 1.1, and 2.0 versions. HTTP/3 isn't supported.

• Deployment scope: you can deploy a Secure Web Proxy instance only in a host project, not in a service project.

Additional Google Cloud tools to consider

You can integrate Secure Web Proxy with the following Google Cloud tools to enhance the overall security posture of your workloads and applications:

• Use frontend mTLS to enable Secure Web Proxy to configure validated client identities in authorization policies and enforce granular access control for outbound traffic.

• Use Certificate Manager to manage the trust anchors (root certificates) and intermediate CAs required to validate client certificates in frontend mTLS connections to Secure Web Proxy.

• Implement VPC Service Controls to prevent data exfiltration from Google Cloud services, such as Cloud Storage and BigQuery.

• Use Trace to get distributed tracing data for outbound requests and analyze end-to-end network latency.

What's next

• Policies and rules
• Roles and permissions
• Initial setup steps
• Deploy Secure Web Proxy as an Agent Gateway