Google Gemini Spark: Always-On Workspace Intelligence, AP2 Protocols, and Cloud VM Isolation

Series: Always-On Autonomous Agents - Part 3
Series: ← Part 2: OpenAI DOTS: Inside the Always-On Agentic Architecture, Bubbly Avatars, and GPT-6 Astra Cloud Sandboxes (Previous)

Summary

Introduced at Google I/O 2026, Gemini Spark represents Google’s strategic entry into persistent, always-on autonomous agents. While traditional assistants wait idly for prompts, Gemini Spark runs 24/7 on dedicated Google Cloud virtual machines, autonomously synthesizing incoming communications, reconciling schedules, drafting business documentation, and monitoring enterprise operations across Google Workspace (Gmail, Calendar, Drive, Docs, Sheets).

Crucially, to enable genuine financial and transactional agency without compromising security, Google paired Spark with the Agent Payments Protocol (AP2)—an open framework donated to the FIDO Alliance establishing cryptographically verifiable digital mandates for autonomous purchasing. This deep dive examines the cloud VM isolation runtime behind Gemini Spark, the mechanics of AP2 “Human Not Present” checkouts, Model Context Protocol (MCP) tool routing, and how Google’s ecosystem-native approach compares directly to Meta Muse and OpenAI Dots.

Official Release & System Specifications

In Demonstration: Google I/O 2026 Keynote & Agentic Architecture

To see how Gemini Spark and autonomous agentic workflows operate across Google Cloud and Workspace, watch the official Google presentation:

Prior Reading Material

To trace the foundations of always-on agent architectures, long-horizon planning, and agent security across this series, review our prior explorations:

• Introducing Meta Muse: Personal AI Agents, Muse Spark, and Secure VM Architecture — Part 1 of this series covering Meta’s Hatch orchestrator, eBPF kernel filters, and personal superintelligence.
• OpenAI DOTS: Inside the Always-On Agentic Architecture, Bubbly Avatars, and GPT-6 Astra Cloud Sandboxes — Part 2 covering OpenAI’s 24/7 background agents, cloud sandboxes, and bubbly avatar interface psychology.
• Gemini 4 Argon: Inside Google’s 1M-Token Output Frontier Model, Enterprise Benchmarks, and Cyber Defense — Google’s massive frontier model for deep reasoning, long-context retrieval, and systems engineering.
• Connecting Google Antigravity and Gemini to OpenClaw: A Complete Migration Guide — Configuring Google’s agentic harnesses, local credentials, and terminal tool calls.
• Google Gemini 3.8 Flash: High-Throughput Multimodal Speed and Efficiency — Sub-second TTFT optimizations and streaming multi-modal tool use.

The Always-On Workspace Paradigm: Moving Beyond Turn-Based Assistants

For years, Google Workspace tools provided smart compose and inline summarization. While helpful, these capabilities were fundamentally reactive: you had to open an email, click a button, or enter a prompt.

Gemini Spark shifts Google’s entire productivity suite into an ambient, proactive operating system. By decoupling the agent daemon from the browser tab and running it continuously on Google Cloud infrastructure, Spark handles multi-stage responsibilities in the background:

“Coordinate next month’s quarterly engineering summit in Chicago: monitor team availability across calendars, reserve a block of conference rooms at an approved downtown venue under $500/night, compile dietary restrictions from team notes into a catering brief, and notify the organizers when finalized.”

While you sleep or focus on deep coding, Gemini Spark executes the workflow across services, checking invariants, parsing replies, and executing transactions within pre-authorized constraints.

flowchart TD
    subgraph Reactive["Legacy Turn-Based Assistant (Episodic Chat)"]
        direction TB
        R1["User Opens Gmail or Docs"] --> R2["User Types Prompt / Requests Summary"]
        R2 --> R3["Model Computes Response"]
        R3 --> R4["User Manually Reviews & Copies Output"]
        R4 --> R5["User Closes Tab / Background Execution Halts"]
    end
    style Reactive fill:#0f172a,stroke:#64748b,stroke-width:2px,color:#ffffff;
    style R1 fill:#1e293b,stroke:#94a3b8,stroke-width:1px,color:#ffffff;
    style R2 fill:#1e293b,stroke:#94a3b8,stroke-width:1px,color:#ffffff;
    style R3 fill:#1e293b,stroke:#94a3b8,stroke-width:1px,color:#ffffff;
    style R4 fill:#334155,stroke:#ef4444,stroke-width:1px,color:#ffffff;
    style R5 fill:#450a0a,stroke:#ef4444,stroke-width:2px,color:#ffffff;

flowchart TD
    subgraph SparkLoop["Google Gemini Spark (Continuous Cloud Daemon)"]
        direction TB
        S1["User Assigns High-Level Objective & AP2 Mandate"] --> S2["Dedicated Google Cloud microVM Daemon Booted"]
        S2 --> S3["Continuous Ingestion: Workspace Webhooks & Pub/Sub Events"]
        S3 --> S4["Antigravity Reasoning Core Analyzes State & Invariants"]
        S4 --> S5{"Action Classification Gate"}
        S5 -- "Read / Summarize / Draft" --> S6["Autonomous Execution: Drive / Docs / Sheets Updated"]
        S5 -- "Financial Checkout / Purchase" --> S7["AP2 Cryptographic Mandate Evaluation"]
        S7 -- "Authorized within Cap" --> S8["Autonomous Checkout Settled with Merchant"]
        S7 -- "Exceeds Constraints" --> S9["Human Approval Notification Sent to Mobile"]
    end
    style SparkLoop fill:#0a0f1d,stroke:#4285f4,stroke-width:2px,color:#ffffff;
    style S1 fill:#172554,stroke:#3b82f6,stroke-width:1px,color:#ffffff;
    style S2 fill:#1e1b4b,stroke:#6366f1,stroke-width:1px,color:#ffffff;
    style S3 fill:#042f2e,stroke:#14b8a6,stroke-width:1px,color:#ffffff;
    style S4 fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#ffffff;
    style S5 fill:#3b0764,stroke:#a855f7,stroke-width:2px,color:#ffffff;
    style S6 fill:#065f46,stroke:#34d399,stroke-width:1px,color:#ffffff;
    style S7 fill:#713f12,stroke:#f59e0b,stroke-width:2px,color:#ffffff;
    style S8 fill:#14532d,stroke:#22c55e,stroke-width:2px,color:#ffffff;
    style S9 fill:#450a0a,stroke:#ef4444,stroke-width:1px,color:#ffffff;

Under the Hood: Cloud VM Sandboxes & the Antigravity Harness

A fundamental challenge in running 24/7 autonomous agents is security and resource containment. Google structured Gemini Spark around two core architectural primitives: Dedicated GCP MicroVMs and the Antigravity Agent Harness.

1. Dedicated Single-Tenant MicroVM Sandboxes

Rather than sharing a shared memory pool, every Gemini Spark instance is allocated an isolated, lightweight virtual machine on Google Cloud Platform:

• Zero Local Footprint: All execution, web crawling, and document compilation occur inside Google’s enterprise-grade cloud datacenters, eliminating battery drain or local CPU consumption.
• Micro-Segmentation: Network egress is tightly restricted through outbound proxy layers. Spark can only communicate with authenticated Google APIs, verified MCP endpoints, and approved payment gateways.
• Isolated State Persistence: Working context, active subtasks, and intermediate artifacts are stored on encrypted ephemeral block storage tied to the user’s Google Cloud tenant.

flowchart TD
    subgraph VMArch["Gemini Spark Cloud VM Sandbox Architecture"]
        direction TB
        V1["Google Cloud Hypervisor (Borg-Managed MicroVM Container)"] --> V2["Isolated Spark Daemon Runtime (Python / C++ Engine)"]
        V2 --> V3["Antigravity Reflexive Loop: Gemini 3.5 Flash (Sub-Second Ingestion)"]
        V3 --> V4["Antigravity Deliberate Loop: Gemini 4 Argon (Deep Plan Synthesis)"]
        V4 --> V5["Google Workspace Native API Mesh (OAuth 2.0 Scopes)"]
        V5 --> V6["Model Context Protocol (MCP) Gateway: 3rd-Party Tool RPCs"]
        V6 --> V7["FIDO AP2 Cryptographic Enforcement Module"]
    end
    style VMArch fill:#0a0f1d,stroke:#00e5ff,stroke-width:2px,color:#ffffff;
    style V1 fill:#0f172a,stroke:#38bdf8,stroke-width:1px,color:#ffffff;
    style V2 fill:#1e1e38,stroke:#818cf8,stroke-width:1px,color:#ffffff;
    style V3 fill:#0c4a6e,stroke:#0284c7,stroke-width:1px,color:#ffffff;
    style V4 fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#ffffff;
    style V5 fill:#14223d,stroke:#38bdf8,stroke-width:1px,color:#ffffff;
    style V6 fill:#2e1065,stroke:#c084fc,stroke-width:1px,color:#ffffff;
    style V7 fill:#713f12,stroke:#f59e0b,stroke-width:2px,color:#ffffff;

2. The Dual-Loop Antigravity Harness

Operating a continuous agent 24/7 using only massive, trillion-parameter reasoning models would be cost-prohibitive. Google utilizes a hierarchical dual-loop agent harness:

• Outer Loop (Reflexive Surveillance): Powered by Gemini 3.5 Flash, this high-speed, cost-efficient model polls webhooks, filters incoming email metadata, verifies calendar conflicts, and maintains situational awareness with sub-second latencies.
• Inner Loop (Deliberate Planning): When a complex multi-step dependency arises (e.g., renegotiating an offsite schedule with external vendors or cross-referencing legal contract terms in Drive), the harness invokes Gemini 4 Argon with its 1,000,000-token output horizon for deep, failure-proof trajectory planning.

The Agent Payments Protocol (AP2): Cryptographic Mandates for Autonomous Commerce

The most significant bottleneck for autonomous agents has never been understanding language—it has been financial trust.

If an agent has raw access to your credit card, a single prompt injection attack could drain your bank account. If an agent has zero purchasing authority, you are constantly interrupted with confirmation prompts for every $10 recurring API subscription or office supply order.

To solve this dilemma, Google introduced the Agent Payments Protocol (AP2) (subsequently donated to the FIDO Alliance as an open industry standard).

flowchart TD
    subgraph AP2Flow["AP2 Cryptographic Mandate & Checkout Lifecycle"]
        direction TB
        M1["User Issues Intent: 'Book hotel in SF under $500'"] --> M2["Client Device Generates AP2 Digital Mandate"]
        M2 --> M3["Mandate Cryptographically Signed via Passkey / FIDO2 Token"]
        M3 --> C1["Constraint Check: Max Spending Cap ($500.00 USD)"]
        C1 --> C2["Whitelist Check: Pre-Approved Hotel Portals Only"]
        C2 --> C3["Temporal Check: 48-Hour Cryptographic Expiration"]
        C3 --> M4["Spark Agent Dispatches Signed Mandate to Merchant Gateway"]
        M4 --> M5{"Merchant & Bank Verify Mandate Signature"}
        M5 -- "Valid & Within Bounds" --> M6["Autonomous Settlement: Human-Not-Present Token Granted"]
        M5 -- "Tampered or Exceeded" --> M7["Transaction Hard Rejected at Banking Rail"]
    end
    style AP2Flow fill:#0b1120,stroke:#f59e0b,stroke-width:2px,color:#ffffff;
    style M1 fill:#1e293b,stroke:#94a3b8,stroke-width:1px,color:#ffffff;
    style M2 fill:#1e1b4b,stroke:#818cf8,stroke-width:1px,color:#ffffff;
    style M3 fill:#3b0764,stroke:#c084fc,stroke-width:2px,color:#ffffff;
    style C1 fill:#111827,stroke:#9ca3af,stroke-width:1px,color:#ffffff;
    style C2 fill:#111827,stroke:#9ca3af,stroke-width:1px,color:#ffffff;
    style C3 fill:#111827,stroke:#9ca3af,stroke-width:1px,color:#ffffff;
    style M4 fill:#0c4a6e,stroke:#0284c7,stroke-width:1px,color:#ffffff;
    style M5 fill:#713f12,stroke:#eab308,stroke-width:2px,color:#ffffff;
    style M6 fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#ffffff;
    style M7 fill:#450a0a,stroke:#ef4444,stroke-width:2px,color:#ffffff;

How AP2 Mandates Work:

1. Cryptographic Proof of Human Intent: Unlike traditional payments where a merchant submits a charge against a card number, an AP2 transaction requires a signed Mandate Object. The user’s biometric authenticator (TouchID / Passkey) signs the mandate payload.
2. Hard Mathematical Guardrails: The mandate explicitly bounds the agent’s authority:
   • Specific spending ceilings (e.g., exactly $$500.00$).
   • Category and merchant domain whitelists (e.g., approved airlines or registered SaaS vendors).
   • Strict expiration timestamps (e.g., valid for 24 hours only).
3. Non-Repudiation for Merchants: Because the mandate is verifiable against the user’s public key registered through FIDO, payment networks and banks support Human Not Present (HNP) authentication without imposing prohibitive chargeback risks on merchants.

Architectural Showdown: Google Gemini Spark vs. OpenAI Dots vs. Meta Muse

With the major frontier labs now fielding always-on agents, each platform reflects the unique engineering DNA of its creator:

Hands-On Simulation: Building a 24/7 Agent Daemon with AP2 Enforcement

To demonstrate how persistent Google Cloud VM daemons evaluate incoming Workspace events and enforce cryptographic AP2 payment mandates in code, we developed an architectural Python simulator.

The script models an active Gemini Spark agent, configures a signed $500 AP2 mandate, executes an autonomous hotel booking, and verifies that unauthorized flight purchases are hard-blocked by protocol constraints.

#!/usr/bin/env python3
"""
Google Gemini Spark & AP2 Architectural Simulator
=================================================
A standalone simulation modeling Google's always-on autonomous agent loop:
  1. Persistent Google Cloud VM Daemon & Cron Execution
  2. Google Workspace Native Connectors (Gmail, Calendar, Drive, Docs, Sheets)
  3. Model Context Protocol (MCP) Third-Party Extension Runtime
  4. Agent Payments Protocol (AP2) Cryptographic Mandate Engine
     - Mandates with pre-authorized spending caps, brand whitelists, and expiration
     - "Human Not Present" autonomous merchant checkout verification
  5. Antigravity Agent Harness (Dual-loop: fast reflexive monitoring vs deep reasoning)

Author: Narendra Vadapalli (https://www.narenvadapalli.com)
License: MIT
"""

import time
import json
import hashlib
import hmac
from dataclasses import dataclass, field
from enum import Enum
from typing import List, Dict, Optional, Tuple


class TaskPriority(Enum):
    ROUTINE_BACKGROUND = "ROUTINE_BACKGROUND"
    TIME_SENSITIVE = "TIME_SENSITIVE"
    CRITICAL_GOVERNANCE = "CRITICAL_GOVERNANCE"


class TransactionState(Enum):
    PENDING_VALIDATION = "PENDING_VALIDATION"
    MANDATE_VERIFIED = "MANDATE_VERIFIED"
    SETTLED = "SETTLED"
    BLOCKED_LIMIT_EXCEEDED = "BLOCKED_LIMIT_EXCEEDED"
    BLOCKED_UNAUTHORIZED_MERCHANT = "BLOCKED_UNAUTHORIZED_MERCHANT"


@dataclass
class AP2PaymentMandate:
    mandate_id: str
    user_id: str
    max_amount_usd: float
    allowed_merchants: List[str]
    expiration_epoch: float
    user_signature: str

    def is_valid(self, merchant: str, amount_usd: float) -> Tuple[bool, str]:
        current_time = time.time()
        if current_time > self.expiration_epoch:
            return False, "Mandate expired"
        if amount_usd > self.max_amount_usd:
            return False, f"Amount ${amount_usd:.2f} exceeds authorized limit ${self.max_amount_usd:.2f}"
        if merchant.lower() not in [m.lower() for m in self.allowed_merchants]:
            return False, f"Merchant '{merchant}' not in pre-authorized whitelist"
        return True, "Valid mandate"


@dataclass
class WorkspaceEvent:
    event_id: str
    source_app: str  # Gmail, Google Calendar, Google Drive
    summary: str
    requires_action: bool
    metadata: Dict = field(default_factory=dict)


class GoogleCloudVMRuntime:
    """Simulates dedicated Google Cloud microVM running the Spark daemon 24/7."""
    def __init__(self, vm_id: str, zone: str = "us-central1-a"):
        self.vm_id = vm_id
        self.zone = zone
        self.daemon_active = True
        self.mcp_servers = ["google-workspace-mcp", "jira-mcp", "fido-ap2-gateway-mcp"]

    def poll_workspace_events(self) -> List[WorkspaceEvent]:
        return [
            WorkspaceEvent(
                event_id="evt-001",
                source_app="Google Calendar",
                summary="Upcoming Quarterly Strategy Offsite in San Francisco (4 attendees)",
                requires_action=True,
                metadata={"location": "San Francisco", "hotel_needed": True, "date": "2026-10-15"}
            ),
            WorkspaceEvent(
                event_id="evt-002",
                source_app="Gmail",
                summary="Client invoice discrepancy flagged in #finance-alerts",
                requires_action=True,
                metadata={"urgency": "high", "thread_id": "thr-9941"}
            ),
            WorkspaceEvent(
                event_id="evt-003",
                source_app="Google Drive",
                summary="Weekly Q3 Cloud Infrastructure Metrics Sheet updated by DevOps",
                requires_action=False,
                metadata={"file_name": "q3_cloud_metrics.xlsx"}
            )
        ]


class AP2PaymentGateway:
    """Simulates FIDO Alliance Agent Payments Protocol (AP2) mandate validation."""
    def __init__(self, secret_key: str = "gcp_enterprise_fido_seed_99"):
        self.secret_key = secret_key
        self.settled_transactions: List[Dict] = []

    def create_mandate(self, user_id: str, max_usd: float, allowed_merchants: List[str], hours_valid: float = 24.0) -> AP2PaymentMandate:
        mandate_id = f"mandate-{hashlib.sha256(str(time.time()).encode()).hexdigest()[:12]}"
        expiration = time.time() + (hours_valid * 3600)
        payload = f"{mandate_id}:{user_id}:{max_usd}:{sorted(allowed_merchants)}:{expiration}"
        sig = hmac.new(self.secret_key.encode(), payload.encode(), hashlib.sha256).hexdigest()
        return AP2PaymentMandate(
            mandate_id=mandate_id,
            user_id=user_id,
            max_amount_usd=max_usd,
            allowed_merchants=allowed_merchants,
            expiration_epoch=expiration,
            user_signature=sig
        )

    def execute_agent_checkout(self, mandate: AP2PaymentMandate, merchant: str, amount_usd: float, purpose: str) -> Dict:
        valid, reason = mandate.is_valid(merchant, amount_usd)
        tx_id = f"tx-{hashlib.md5(f'{merchant}{amount_usd}{time.time()}'.encode()).hexdigest()[:8]}"
        
        if not valid:
            return {
                "tx_id": tx_id,
                "status": TransactionState.BLOCKED_LIMIT_EXCEEDED if "exceeds" in reason else TransactionState.BLOCKED_UNAUTHORIZED_MERCHANT,
                "reason": reason,
                "amount_usd": amount_usd,
                "merchant": merchant
            }

        record = {
            "tx_id": tx_id,
            "status": TransactionState.SETTLED,
            "mandate_id": mandate.mandate_id,
            "merchant": merchant,
            "amount_usd": amount_usd,
            "purpose": purpose,
            "timestamp": time.time()
        }
        self.settled_transactions.append(record)
        return record


class GeminiSparkAgent:
    """Simulates the Gemini Spark agent running on Google Cloud VM."""
    def __init__(self, agent_name: str = "Gemini-Spark-Enterprise"):
        self.name = agent_name
        self.vm = GoogleCloudVMRuntime(vm_id="gcp-spark-vm-us-central1-01")
        self.ap2_gateway = AP2PaymentGateway()
        self.execution_log: List[str] = []

    def run_autonomous_cycle(self, active_mandate: AP2PaymentMandate):
        self.execution_log.append(f"[{self.name}] Booting daemon cycle on {self.vm.vm_id}...")
        events = self.vm.poll_workspace_events()

        for evt in events:
            if not evt.requires_action:
                self.execution_log.append(f"  • Ignored routine event: {evt.source_app} - {evt.summary}")
                continue

            self.execution_log.append(f"  ⚡ Processing Actionable Event: [{evt.source_app}] {evt.summary}")

            if "Offsite" in evt.summary and evt.metadata.get("hotel_needed"):
                merchant = "Marriott San Francisco Union Square"
                cost = 450.00
                res = self.ap2_gateway.execute_agent_checkout(
                    mandate=active_mandate,
                    merchant=merchant,
                    amount_usd=cost,
                    purpose="Conference hotel room block for Q4 strategy offsite"
                )
                if res["status"] == TransactionState.SETTLED:
                    self.execution_log.append(
                        f"    ✅ [AP2 SETTLED] Autonomously booked {merchant} (${cost:.2f}) via Mandate {active_mandate.mandate_id}"
                    )
                else:
                    self.execution_log.append(
                        f"    ❌ [AP2 BLOCKED] Transaction rejected: {res['reason']}"
                    )

            elif "invoice" in evt.summary.lower():
                self.execution_log.append(
                    f"    📝 [Google Docs / Sheets] Cross-referenced invoice line items against Q3 purchase orders; draft audit report saved to Drive."
                )


def main():
    print("=" * 80)
    print("  GOOGLE GEMINI SPARK & AP2 PROTOCOL ARCHITECTURAL SIMULATOR")
    print("=" * 80)

    spark = GeminiSparkAgent()

    mandate = spark.ap2_gateway.create_mandate(
        user_id="user_naren_enterprise",
        max_usd=500.00,
        allowed_merchants=["Marriott San Francisco Union Square", "Hyatt Regency SF", "Hilton SF Financial"],
        hours_valid=48.0
    )

    print(f"\n[AP2 Mandate Issued]")
    print(f"  • Mandate ID       : {mandate.mandate_id}")
    print(f"  • Max Amount (USD) : ${mandate.max_amount_usd:.2f}")
    print(f"  • Approved Whitelist: {mandate.allowed_merchants}")
    print(f"  • Cryptographic Sig : {mandate.user_signature[:24]}...")
    print("-" * 80)

    print("\n[Executing 24/7 Background Workspace Loop]")
    spark.run_autonomous_cycle(active_mandate=mandate)

    for entry in spark.execution_log:
        print(entry)

    print("\n[Testing AP2 Security Interlock: Exceeding Authorized Spending Cap]")
    unauthorized_res = spark.ap2_gateway.execute_agent_checkout(
        mandate=mandate,
        merchant="United Airlines",
        amount_usd=1200.00,
        purpose="First-class flight upgrade"
    )
    print(f"  Attempt: United Airlines ($1200.00)")
    print(f"  Outcome: {unauthorized_res['status'].name}")
    print(f"  Reason : {unauthorized_res['reason']}")

    print("\n" + "=" * 80)
    print("  SIMULATION COMPLETE: ZERO-TRUST AP2 MANDATES ENFORCED AUTONOMOUSLY")
    print("=" * 80)


if __name__ == "__main__":
    main()

Conclusion & What’s Next in the Series

By combining persistent Google Cloud microVM daemons with the open FIDO Agent Payments Protocol (AP2), Google has positioned Gemini Spark as an ambient productivity partner with genuine execution authority. Rather than forcing users into a new conversational destination, Spark integrates directly into the software fabric where billions of knowledge workers already spend their days: Google Workspace.

In the next installment of our Always-On Autonomous Agents mini-series, we explore how Perplexity is expanding digital workers from the cloud down to local edge hardware:

• Part 4: Perplexity Computer: The Multi-Model Digital Worker, 400+ Connectors, and Portable Sandboxes — How Perplexity decomposes complex asynchronous DAGs across heterogeneous frontier models (Claude, GPT, Gemini, Grok) and runs workflows on local NVIDIA hardware via Portable Computer.

Stay tuned as we continue deconstructing the frontier of always-on agent architectures.