Deliverd

Gemini Enterprise

Add Deliverd to Gemini Enterprise as an A2A agent: see what waits for your decision, ask for approval and check a request without leaving Gemini.

Deliverd is an A2A agent (Agent2Agent protocol, version 0.3). Once it is added to a Gemini Enterprise app, each person signs in to Deliverd as themselves and can ask it three things:

SkillSayGets back
What is waiting for me"What approvals are waiting for me?"Up to ten requests waiting for their decision, newest first, each with its link.
Ask for approval"Ask: Pay invoice 4471 for £14,280" (the detail on the next lines, then "Approvers: finance")The request, sent to the right people, and its link.
Check a request"Where is request 3f2c…?"Where it stands, and who decided.

An agent that Gemini runs can send structured data instead of text. For example, { "skill": "ask", "title": "…", "approvers": ["finance"], "externalId": "po-1" } or { "skill": "status", "id": "…" }. Each reply has the sentence for a person and the same facts as data.

Before you start

  • A Gemini Enterprise app, and an administrator who can add agents to it. Adding A2A agents is in preview at Google.
  • A Deliverd organisation that the people using Gemini belong to.

Connect

  1. 1

    Register Gemini Enterprise

    Run the first command below once. It returns a client_id (it starts dlvc_) and a client_secret. Gemini's form asks for both, so this registers a confidential client.

  2. 2

    Add the agent

    In the Google Cloud console, open your Gemini Enterprise app and go to Agents → Add agents → Custom agent via A2A. Paste Deliverd's agent card (the second command prints it) and choose Preview agent details.

  3. 3

    Set up sign-in

    When Gemini asks for authorization, fill in the settings below with the client ID and secret from step 1.

  4. 4

    Sign in

    The first time someone uses the agent, Gemini sends them to Deliverd to choose their organisation and approve. There is no key to paste.

Register Gemini Enterprise (step 1)

curl -X POST https://deliverd.dev/api/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Gemini Enterprise",
    "redirect_uris": ["https://vertexaisearch.cloud.google.com/static/oauth/oauth.html", "https://vertexaisearch.cloud.google.com/oauth-redirect"],
    "token_endpoint_auth_method": "client_secret_post"
  }'

The agent card (step 2)

curl https://deliverd.dev/.well-known/agent-card.json

Gemini's sign-in settings (step 3)

Client ID:          the dlvc_… value from step 1
Client secret:      the client_secret from step 1
Authorization URI:  https://deliverd.dev/oauth/authorize?response_type=code&client_id=<client ID>&redirect_uri=https%3A%2F%2Fvertexaisearch.cloud.google.com%2Fstatic%2Foauth%2Foauth.html
Token URI:          https://deliverd.dev/api/oauth/token
Scopes:             approvals:read approvals:write offline_access

For the security review

  • Each person signs in as themselves, so what they see is their own inbox, and every request they make is made in their name.
  • Gemini's callback, https://vertexaisearch.cloud.google.com/static/oauth/oauth.html, is recognised by Deliverd. That means it is allowed in organisations that only allow recognised apps.
  • The agent cannot approve, decline or change a request. It reads and asks.
  • Replies are messages, not tasks: nothing is kept between turns, and nothing streams.