Google built a security cage for AI agents on Android, but it's still empty

After I heard someone say that Google is bringing settings to control AI agents on Android, my inquisitive nature grabbed a magnifying glass and went looking.

I expected to find something in my phone's Settings app, a toggle of some sort, a permission list, or something I could actually tap. My phone didn't have anything like it, but I found something somewhere else.

What I found wasn't on my Google Pixel, but buried in developer documents, SDK release notes, and a permission registry that most Android users will never see.

Google built a real, functioning security cage for autonomous AI agents on Android. The twist is that there's nothing inside it.

Related

5 reasons you should use Gemini on Android instead of a third-party assistant

Gemini is the ideal virtual assistant for Android

Posts 5
By  Zach Gray-Traverso

The permission exists, and it's empty

EXECUTE_APP_FUNCTIONS is real, just not for you yet

Android houses a system permission called EXECUTE_APP_FUNCTIONS. It's only reserved for approved agents. Any app or assistant needs it before it can discover or run another app's functions.

That permission isn't sitting on a menu you'd stumble into while tinkering with your phone. It's not even in the Developer options. It lives in Android's "AppFunctionsManager" framework.

It's the part of the OS built to manage this handoff, and it's gated almost entirely to first-party Google software like Gemini.

AppFunctions is the motor behind all of it

Apps hand over a shortcut instead of getting tapped on

Here's how it works and what it's for. Instead of an AI agent faking a finger-tapping operation around your screen like you would, developers can build a shortcut to a specific action inside their app.

Google compares this to letting outside tools connect to a service instead of using it like a person.

When that shortcut exists, Android keeps track of it.

For instance, ask Gemini to book a ride, and instead of opening the app and hunting for buttons for you, it should trigger that action. It's like a hyperlink for a specific task.

This means no tapping, no risk of a missing button because the app moved something in an update. It means the agent will keep a record of shortcuts instead of the full operation.

It's a cleaner, more straightforward way to accomplish a task, and less likely to break. However, it will only work after a developer has built the shortcut, and right now, almost nobody has.

The reason that it's still a ghost town

Everything here is still labeled preview or alpha

Gemini's access to this system is limited to a small, in-house group of testers that Google handpicked. The program has no timeline for when it will see daylight.

That means the program could also change without any warning, so you'd better not get your hopes up just yet.

Getting real access now means applying to an early program and waiting to see if you're picked, with no guarantee of being selected. For most developers, that's not worth the effort, especially when the ground could shake out from under them at any point.

This isn't Google being slow. Gemini is already built into ten Google apps, but only three of them are actually useful.

The tools just keep showing up before the actual experience does, and to be fair, this is the right move.

Building the cage before the tenant arrives is the right call

Android usually does this the other way around

Android has a habit of shipping features first, and locking them down after something goes south.

Location, background data, and notifications all started wide open before eventually getting the strict permission prompts everyone dismisses today without realizing the consequences.

Doing the same with AI would be worse. An agent that can run free could read messages or move money before you notice anything is off. This isn't the same risk as an app that wants your location in the background.

Locking this down now, before developers have ample reasons to push back, means the rules exist before anyone's tempted to cut corners. This is crucial before real money or real users are involved.

There's clearly appetite for this. Third-party developers have built Android agents the old way, tapping through screens via ADB, which is the fragile approach AppFunctions tries to avoid.

Right now, it's a cage with nothing in it

But empty doesn't mean pointless

Android's AI agent permissions are carefully curated, detailed, and currently control almost nothing on a typical phone.

That doesn't mean Google dropped the ball on this one. It's closer to a security team finishing the blueprints before the building has a single tenant lined up.

That won't stay like this forever, though. Google's agent ambitions go beyond your phone, with a cloud agent that works around the clock on Gmail and Docs, and this permission is waiting for that same thing to happen on your phone.

For now, the cage is built, tested, and locked. Nobody's moved in yet.