Article
ADK Agent Identity on Google Cloud: Separate Identities, Separate Blast Radius
When one ADK agent delegates to another, identity is not inherited along the way: two Cloud Run services, two service accounts, and the IAM binding that actually defines blast radius.