
Every section of the official guide walked in its own order, with one anchor example and one exam flag each. Also the two things in it people do not expect: a Google exam that names Claude Code, and a hands-on lab half that no video can sit for you. Ends on a worked question with the wrong options struck one at a time.
A support team builds a returns helper in a week with no developer, and every gap in it turns out to be one bullet of this section. Pages, transition routes and event handlers read as a state machine, guardrails the console enforces against instructions the model merely follows, ingestion against federation on enterprise data, and where a photo goes instead of into an index.
Tool access, MCP servers and custom skills on a coding agent, then the allow, ask and deny lists and why a deny beats a sentence in a rule file. Then the sandbox question the exam actually asks: an isolated box on the developer's own machine, Cloud Workstations, or GKE. Run against the shop's returns service, on a verified injection bug and a policy file re-read from disk on every request.
Making one developer's setup repeatable and handing it to a team. A skill loads only when the job matches. A rule can be set to always on and is still only advice, which is why a hook is the thing that can deny a push live on screen. A test-runner subagent gets a tools list that reads, searches and runs commands with nothing in it that can edit a file, and one plugin folder installs the lot. Then Agents CLI, for the agents Larkspur ships.
The first decision in the largest section. The exam grades it on cost, security and the agent's architecture rather than on size. Model Garden's tiers, serverless against an endpoint deployed inside your own project, and a Cloud Run form where one checkbox attaches a GPU. Hosting the model yourself has to be paid for by something in the stem, usually data that may not leave the project, and that is also where open weights beat proprietary.
The assistant answers a customer today and asks for her order number again tomorrow. The agent file, a tool as a plain function with a docstring, and one turn broken into a list of events in the dev UI. Then session state and its prefixes, the three places a session can live, and Memory Bank for what has to survive the chat.
An agent promises a return the policy forbids, because it never read the policy. Chunks, embeddings and cosine similarity over four real policy files first, then the managed versions: RAG Engine, Vector Search, hybrid search for when part numbers keep getting missed, and the two rerankers. The last stretch turns to permissions, where Agent Identity is granted with no key file to download anywhere, and Google's own MCP servers and Agent Registry are how prebuilt capability gets attached.
One agent holding every tool, split into specialists, and the question becomes who talks to whom and over what. A transfer against an agent tool, MCP to reach a tool and A2A to reach another company's agent with its own state, then sequential, parallel, loop and graph workflows for when no model should be picking the order.
A bug that three hand-typed tests missed. A golden case is captured from a real chat a person approved, edge cases are written by hand, and the tool path is scored on an exact match. When a correct reply's wording moves between runs, a judge model scores it instead. Then the same run leaves the dev UI for a terminal so a build server can gate a deploy on it. The evaluation service's metrics, a custom autorater and an online monitor sampling live traffic are where the same idea goes once the agent is live.
Agent Runtime, Cloud Run and GKE, and what has to be in a question before a cluster is the right answer. Then the first week in production: stopping a runaway loop with an iteration cap and an exit tool instead of another prompt sentence, and a trace where the tool span outruns both model calls, so the fix is a cache and not a prompt word.
A shared robot account nobody can audit, replaced by a deployment with a name of its own, granted one bucket, read only. A carrier's API key goes into a vault the agent may use and no person can read back. Then a principal access boundary, which is the cap a later grant cannot widen. The registry lists what may be called, the gateway is the one door those calls travel through, and Model Armor reads what passes.
Whose authority a call carries when it reaches the data, and who says yes before it runs. A token is vaulted per person and injected into the call, so the far end enforces the employee's own permissions. A plain-English governance policy runs in dry run before it enforces anything. A deny policy is the hard boundary, because a written rule is a check and never the boundary. A refund stops dead until a person types yes.
Twelve lessons walking the official exam guide in its own order and at its own weighting. Every lesson teaches its objective and then works the exam's own question shape on screen, striking the wrong options one at a time and saying why each one fails. The reason is the part that still works on a question you have not seen.
The certification has two halves and you need both. There is a proctored multiple-choice exam, and there are hands-on labs on Google Skills. No video can do a lab for you, so this course does not pretend to. It teaches the multiple-choice half, section by section, and every section's lessons send you to Google's own learning path for this certification to do the labs before you sit.
The opening lesson walks the whole map: five sections, what each one really tests, and one flag from each. The other eleven follow the guide's own order, and how many lessons a section gets follows its weighting, so your study hours land where the marks are. Section 1, building agents using low-code tools, about 13 percent, one lesson. Section 2, using coding agents for application development, about 17 percent, two lessons. Section 3, developing custom agents, about 33 percent and the largest part of the paper, four lessons. Section 4, evaluating and deploying agentic workflows, about 22 percent, two lessons. Section 5, securing and governing agentic workflows, about 15 percent, two lessons.
Two rules carry a lot of this paper. The first is fit. When an objective says select the appropriate thing and then names cost, security or scale, the credited option is the one that meets that requirement with the least for you to run. The wrong options are usually a real product doing the wrong job, or the right product doing more than the question asked. The second rule is that the agent is a principal, so an access question is really asking who the agent is and what it is allowed to reach. When a stem says must never, the answer is a policy, and no sentence you add to a prompt is the control.
Each lesson carries five flags. A flag is a trigger phrase a question stem uses and the answer that phrase wants. When a stem says sandbox, the answer is isolation. A stem naming another company's agent with its own state is asking for A2A, not MCP. Sixty flags across the twelve lessons. In the section lessons they land together in a recap near the end, and the opening lesson spreads its five across the five sections.
The worked questions come in the exam's own shape. Two or three sentences about a company and what it needs, one question, four options, and the wrong ones struck one at a time. Twenty-three of them across the course: the opening lesson ends on one, and the other eleven carry two each. Every one was written from the published exam guide. None are leaked exam questions.
Most of what you watch is a session that was run and recorded. You watch one turn break apart into events in the ADK dev UI. A tool writes to session state and the instruction reads it back. Hybrid search runs an exact-word lane beside the meaning lane, so a part number is matched word for word. An eval set gets scored, then the same run moves to a terminal so a build server can gate a deploy on it. One folder deploys to Agent Runtime, then the same folder to Cloud Run. A trace shows the slow span is the tool, not the model. A deployed agent reads one bucket under a name of its own, with no key file anywhere. Model Armor catches a forget-your-rules prompt as an injection, and a refund tool returns pending until a person types yes.
The rest is drawn on paper, and you can always tell which is which. The opening lesson is drawn end to end, because it is the exam guide itself being walked and there is no console in it. The last lesson is mostly drawn, because the chain a person's authority travels along has no single screen to point at. In between, a few pieces had no page to open on the machine this was filmed on, and those are taught on a drawn card instead of being staged to look live. The platform stack in the orchestration lesson is one of them.
One company runs through all twelve lessons. Larkspur is an online shop. Its support team clicks a returns helper together in low-code with no developer, and every gap in that helper turns out to be one bullet of section 1. Its developers then put coding agents on the shop's returns service, to patch a vulnerability a scan found and to fix a policy file the service re-reads from disk on every request. The returns assistant itself gets rebuilt in code and carried up through the rest of the guide: a model picked per step, sessions and memory, retrieval over the shop's own policy, specialists split out behind protocols, an eval set, a deployment, an identity, a gateway, and a person who approves the refund. Every idea shows up as a problem in that build before it gets a name, because the exam asks scenario questions and that is the shape they come in.
Product names in this area move. Agent Engine became Agent Runtime, and Vertex AI Search became Agent Search. The lessons use the guide's own name for a thing, and say the old name once where a question could still carry it. They also do not walk you through a console click by click, because interfaces get redesigned. The lessons teach the decision behind each product, and the questions are written about that decision, not about the button.
Written for people who already build. The guide suggests around three years of cloud work and about a year building agents on Google Cloud, and that suggestion is fair. If a tool call and a service account are both new ideas, this is the wrong starting point and a beginner agents course will serve you better first. If you know cloud but have never built an agent, the four custom-agent lessons are where your hours should go.
The exam itself
These are Google's published figures for this certification. Where Google has published nothing, this block says so rather than guessing.
Two parts, and both are required: a proctored multiple-choice exam, and hands-on labs on Google Skills.
The multiple-choice part is about 80 questions in 3 hours, in English, sat online or at a test centre.
Results come 4 to 6 weeks after both the exam window and the lab window close. The certification is valid for one year.
There are no prerequisites. The guide recommends 3 or more years of cloud work and a year or more building agentic solutions on Google Cloud.
Google sets the fee and publishes it on the certification page. No figure is quoted here, because a price sitting on a course page goes wrong quietly and a wrong number is worse than none.
Google has not published a passing score, so this course does not quote one. It has not published a lab count or a lab time limit either, beyond that the lab half exists and is required.
Finishing gives you a certificate of completion from this platform, which records that you did the course. It is not the Google credential. That one comes from passing both halves of the real exam.
AI use disclosure
AI tools were used throughout the production of this course, including the on-screen animation system, the research behind each lesson, the drafting of the scripts, and the tooling that assembles the videos. Before recording anything, I checked every lesson against the official exam guide and Google's own documentation. Where you see a terminal or a console, that is a session that was run and recorded, not a mock-up.