A pooled token budget solves one finance problem and creates one governance problem: the busiest agent can consume capacity purchased for everyone else. Google now gives Gemini Enterprise administrators project caps and an overage switch. Per-user and team controls are still coming later.
Google Antigravity Gemini Enterprise availability expanded on August 20, 2026. Google says eligible Gemini Enterprise app subscriptions now include Antigravity, its coding-agent environment, with consolidated spend, security, observability, and usage controls.
The eligible list includes Gemini Enterprise Standard, Plus, and Standard Emerging Market licenses. Developers can use Antigravity through its 2.0 desktop application, CLI, and extensions for VS Code, Visual Studio, JetBrains, and Zed, with several of those integrations still labeled preview.
The subscription is shared, but control is not yet equally granular
Google’s billing design pools token quota across an organization. That reduces stranded capacity when one team is quiet and another has a busy release. Administrators can set monthly project-level budget caps in the Billing console and can opt into overages with a separate monthly spend cap.
Per-user and team controls are planned for later in 2026. Until they arrive, the project boundary carries more weight. A company that puts unrelated teams inside one project may struggle to assign cost, prevent a runaway job, or preserve capacity for a production incident.
I would not enable overages on day one. First observe two billing cycles, identify retry storms and long-running tasks, then set an overage cap smaller than the pooled quota. Continuous work is useful only when the fallback cannot become an unbounded invoice.
MCP access belongs in the threat model
Google says workspace policy can configure sandboxing, browser access, Model Context Protocol connections, and related agent capabilities. These are not convenience settings. They define what code, systems, credentials, and external services an agent can reach.
An MCP server can expose a source-code host, ticket system, database, deployment API, or internal knowledge base. Its name says little about the authority behind each tool. Administrators should inventory server owners, transport, authentication, scopes, write actions, data classes, and the behavior when the server is unavailable or returns an unexpected schema.
Our article on Gemini Managed Agent hooks shows why failure behavior deserves a test. A policy or tool service that silently fails open can turn a documented boundary into a suggestion.
Audit logs create a second sensitive dataset
Google says centralized audit logs capture prompts, agent responses, and metadata. That can help an incident reviewer reconstruct what the agent saw and did. It also means the governance system may store source code, secrets copied into prompts, customer information, or model output that the application itself would not otherwise retain.
Before rollout, define who can search those logs, how long they are kept, which region holds them, whether administrators can export them, and how deletion works when a repository or employee account is removed. Redaction should happen before storage where possible. Access to the audit trail should be narrower than access to the coding tool.
| Control | Owner | Test before enablement |
|---|---|---|
| Project budget cap | FinOps | Run a retry storm and confirm the stop point |
| Overage switch | Finance + engineering | Verify alerting before standard rates begin |
| MCP allowlist | Security | Attempt an unauthorized write and a schema change |
| Browser access | Security + legal | Test downloads, redirects, uploads, and external logins |
| Audit-log access | Security + privacy | Search for secrets, inspect retention, and test deletion |
Identity should not depend on a developer laptop
Google lists Workload Identity Federation and Application Default Credentials support. That gives teams a route away from long-lived service-account keys stored on a workstation or inside a script.
The useful pattern is short-lived, workload-bound identity with separate roles for reading code, opening a pull request, running tests, and deploying. A local agent should not inherit every permission of the human who launched it. Production credentials should require a different path and, for consequential actions, a human approval.
The same separation belongs in model routing. Our review of NVIDIA NeMo Switchyard explains why a model router and its providers need explicit trust, cost, and data boundaries. An enterprise coding surface adds tool authority on top.
A 10-step administrator checklist
- Create separate projects for teams with different budgets or data boundaries.
- Set a project cap before inviting the first production repository.
- Leave overages off until alerts and a stop procedure have been exercised.
- Use pooled quota dashboards to find heavy users and retry loops, not to score developer quality.
- Allowlist MCP servers and document every read and write capability.
- Start browser access with a narrow domain list and no stored personal session.
- Use workload identity and short-lived credentials instead of copied keys.
- Restrict audit-log search, set retention, and scan for secrets.
- Test the IDE, CLI, and desktop paths separately because their permissions can differ.
- Define rollback: revoke the license, credentials, MCP access, and active jobs, then preserve the incident record.
My verdict: project boundaries are the first control
Google has put the right control categories next to Antigravity: budgets, pooled quotas, overage caps, usage metrics, sandboxing, MCP policy, identity, and audit logs. That is a stronger enterprise story than adding a coding agent to another editor.
The rollout still has a granularity gap because per-user and team spend controls are not available yet. I would structure projects around real ownership boundaries, keep overages disabled, and run an MCP permission test before broad enablement. The pooled subscription should not become a pooled blast radius.
Read Google’s documentation
- Read the Antigravity enterprise announcement.
- Review eligible licenses and administrator setup.
- Check Antigravity’s product documentation and integrations.
- Review Google’s Workload Identity Federation guidance.
Which single Antigravity project could spend the pooled quota or reach the widest set of tools today?
Checked August 24, 2026. Availability, eligible plans, spend controls, pooled quotas, overages, integrations, security settings, and audit-log fields are Google statements. Per-user and team spend controls were described as coming later in 2026.
