DEV Community

Cover image for Google SAM (Sovereign Agent Mesh): The Secure Networking Layer for AI Agents
anubhavbhatt
anubhavbhatt

Posted on

Google SAM (Sovereign Agent Mesh): The Secure Networking Layer for AI Agents

#ai #agents #networking #security

AI agents are rapidly moving from simple chatbots to autonomous systems that can use tools, delegate work, and collaborate with other agents. As these systems spread across cloud, on-premises servers, laptops, and edge devices, a new challenge emerges: how do agents communicate securely without exposing internal tools and services to the public internet?

Google's SAM — Sovereign Agent Mesh — is an open-source project designed to address this networking problem. It provides a zero-config, zero-trust P2P mesh through which agents can discover, communicate with, and invoke tools across different environments. Importantly, the current repository states that SAM is not an officially supported Google product.

What Google SAM Actually Is

  • SAM is a secure networking layer for autonomous AI agents, rather than an AI model or agent framework.
  • It creates a private P2P mesh where agents can discover services and invoke tools without requiring every service to be exposed through public APIs.
  • Its design emphasizes zero configuration, zero trust, self-healing connectivity, and portable cryptographic identities across cloud, local, and edge environments.

🏗️ SAM Architecture and Components

SAM is built around three primary components:

  • sam-control-plane — manages node identity registration, authorization policies, and coordination.
  • sam-router — provides libp2p bootstrap and relay functionality for data-plane connectivity.
  • sam-node — runs locally with the agent and provides mesh transport plus MCP sidecar routing.

A simplified architecture looks like:

                  SAM CONTROL PLANE
              Identity + Authorization
                        │
               ┌────────┴────────┐
               │                 │
          SAM Router        SAM Router
               │                 │
        ┌──────┴─────────────────┴──────┐
        │            SAM Mesh            │
        └──────┬──────────┬─────────────┘
               │          │
           SAM Node    SAM Node
               │          │
            Agent       Agent
               │          │
              MCP       MCP
               │          │
             Tools     Tools
Enter fullscreen mode Exit fullscreen mode

🤖 How Agents Communicate With Each Other

  • SAM nodes provide the secure network path between agents, even when those agents run in different environments or behind complicated network topologies.
  • Agents can dynamically discover and invoke tools exposed through the mesh instead of requiring every tool to have a publicly reachable endpoint.
  • SAM can work with agents such as Gemini and Claude, while MCP provides the tool interface exposed to those agents.

For example:

 Gemini Agent
      │
      │ SAM Mesh
      ▼
 Research Agent
      │
      │ MCP
      ▼
 Internal Database
Enter fullscreen mode Exit fullscreen mode

🔐 Identity, Authentication, Authorization and Trust

Security is one of SAM's core ideas.

  • Nodes obtain cryptographic identities and authenticate when joining the mesh; the current flow uses OIDC-based enrollment and a Biscuit-based identity credential.
  • The mesh is isolated and closed by default. Simply joining a mesh does not automatically expose an agent's tools to other nodes.
  • Authorization policies determine which agents can access which services, creating explicit trust boundaries between agents and resources.

This changes the security model from:

 Agent → API Key → Public API
Enter fullscreen mode Exit fullscreen mode

to something closer to:

 Agent Identity
       ↓
 Authorization Policy
       ↓
 SAM Mesh
       ↓
 Authorized Tool
Enter fullscreen mode Exit fullscreen mode

☁️ How SAM Relates to Google Cloud, Vertex AI, Gemini, MCP and A2A

These technologies solve different layers of the agent stack:

 | Technology       | Main Purpose                            |
 | ---------------- | --------------------------------------- |
 | Gemini           | AI model/reasoning                      |
 | ADK              | Agent development framework             |
 | MCP              | Agent ↔ Tool communication             |
 | A2A              | Agent ↔ Agent collaboration            |
 | SAM              | Secure P2P networking and authorization |
 | Agent Engine     | Managed runtime for production agents   |
Enter fullscreen mode Exit fullscreen mode

Google's Cloud architecture already demonstrates combinations of ADK, MCP, A2A and Agent Engine for multi-agent systems.

The easiest way to remember the relationship is:

 Gemini
   ↓
 Brain

 ADK
   ↓
 Agent

 MCP
   ↓
 Tools

 A2A
   ↓
 Agent ↔ Agent communication

 SAM
   ↓
 Secure Agent Network

 Agent Engine / Cloud Run
   ↓
 Where the agent runs
Enter fullscreen mode Exit fullscreen mode

A2A was introduced by Google specifically to standardize communication and collaboration between independent agents, while MCP focuses on connecting agents with tools and data.

🌐 Why "Sovereign" Matters

"Sovereign" refers to maintaining control over where agents run, who they trust, what they can access, and how their communications are governed.

This becomes important when an organization has:

  • Agents running across GCP, AWS, Azure and on-premises infrastructure.
  • Sensitive tools and databases that should not be exposed publicly.
  • Different security policies for different agents or departments.
  • Regulatory or data-residency requirements.

Instead of forcing everything through one centralized public gateway, SAM is designed around a controlled mesh where organizations can define their own trust boundaries.

💻 Practical Example: Building a Sovereign Agent Mesh

Imagine an e-commerce company with 950 products, 17 categories and 43 subcategories.

You could create specialized agents:

                     Master Agent
                        Gemini
                          │
         ┌────────────────┼────────────────┐
         │                │                │
    Product Agent     SEO Agent       Pricing Agent
         │                │                │
      Product DB      Search APIs     Pricing DB
         │
         ▼
    Image Agent
         │
         ▼
        GCS
Enter fullscreen mode Exit fullscreen mode

Each agent could expose selected capabilities through MCP.

SAM would provide the secure connectivity between these agents, while A2A could be used when the agents need to collaborate directly.

For example:

 Master Agent
      │
      │ "Generate SEO content for Product X"
      ▼
 Product Agent
      │
      │ product information
      ▼
 SEO Agent
      │
      │ generated metadata
      ▼
 Master Agent
Enter fullscreen mode Exit fullscreen mode

This allows the individual agents to remain specialized while still participating in one secure mesh.

⚔️ SAM vs MCP vs A2A vs Agent Engine

The technologies are complementary rather than direct competitors.

### MCP

Question: "How does an agent use a tool?"

 Agent → MCP → Database/API/File system
Enter fullscreen mode Exit fullscreen mode

MCP defines the tool/context interface.

A2A

Question: "How does one agent collaborate with another agent?"

 Agent A → A2A → Agent B
Enter fullscreen mode Exit fullscreen mode

A2A provides standardized agent discovery and collaboration.

SAM

Question: "How do agents securely reach each other and their tools across networks?"

 Agent A
    ↓
  SAM Mesh
    ↓
 Agent B / MCP Server
Enter fullscreen mode Exit fullscreen mode

SAM operates closer to the networking and authorization layer.

Agent Engine

Question: "Where do I run my production agents?"

Agent Engine provides managed infrastructure for deploying agents, including capabilities such as authentication, sessions, memory and observability.

So the four can potentially work together:

                     Gemini
                       │
                      ADK
                       │
             ┌─────────┴─────────┐
             │                   │
            A2A                 MCP
             │                   │
             └─────────┬─────────┘
                       │
                      SAM
                       │
               Secure Agent Mesh
                       │
           ┌───────────┼───────────┐
           ▼           ▼           ▼
         GCP         AWS        On-Prem
Enter fullscreen mode Exit fullscreen mode

🚀 Could You Use SAM for Your Own Applications?

Yes, but I would treat it as an experimental/open-source infrastructure component rather than a mature managed Google Cloud service today.

The project provides a public testnet and documentation for running your own control plane, router and nodes, including Kubernetes deployment options.

For a simple application:

 Django/FastAPI
       ↓
 Gemini
       ↓
 MCP
Enter fullscreen mode Exit fullscreen mode

SAM would probably add unnecessary complexity.

For a larger system with:

 20+ specialized agents
         +
 multiple clouds
         +
 on-prem infrastructure
         +
 private databases
         +
 strict authorization
Enter fullscreen mode Exit fullscreen mode

SAM becomes much more interesting.

A practical adoption path

  1. Start with Gemini + ADK to build individual agents.
  2. Add MCP so agents can securely interact with your existing APIs, databases and tools.
  3. Introduce A2A when multiple agents need to collaborate.
  4. Deploy agents independently using Cloud Run, Kubernetes or Agent Engine.
  5. Evaluate SAM when networking, identity and cross-environment authorization become the bottleneck.
  6. Run your own SAM control plane rather than depending on a public test environment for serious workloads.

🎯 Final Takeaway

SAM is best understood as the networking and trust layer underneath a multi-agent architecture.

                  ┌──────────────┐
                  │    Gemini    │
                  │    "Brain"   │
                  └──────┬───────┘
                         │
                  ┌──────▼───────┐
                  │     ADK      │
                  │   "Agent"    │
                  └──────┬───────┘
                         │
              ┌──────────┴──────────┐
              │                     │
         ┌────▼─────┐          ┌────▼─────┐
         │    MCP   │          │    A2A   │
         │   Tools  │          │ Agents   │
         └────┬─────┘          └────┬─────┘
              │                     │
              └──────────┬──────────┘
                         │
                   ┌─────▼─────┐
                   │    SAM    │
                   │  Network  │
                   │ + Trust   │
                   └─────┬─────┘
                         │
           ┌─────────────┼─────────────┐
           ▼             ▼             ▼
         Cloud         On-Prem        Edge
Enter fullscreen mode Exit fullscreen mode

The important distinction is that SAM isn't trying to replace MCP or A2A. MCP handles tools, A2A handles agent collaboration, and SAM provides the secure mesh and trust infrastructure underneath them.

One important 2026 caveat: although SAM lives in Google's google/sam GitHub organization, its repository explicitly says it is not an officially supported Google product. Treat it as an emerging open-source project and evaluate its maturity, security model and operational requirements before using it in production.

Top comments (0)