before_agent_callback returns content and skips the agent when the bearer is missing or userinfo rejects it. Returning None is the only path into the agent body.
Getting started, including the planned sample, is Google ADK.
What fails closed
A callback with no token, or a token userinfo rejects, returns content whose text is unauthorized. The agent body does not run.
A callback with a bearer userinfo accepts stores the subject and returns None.
A resolved subject is not authorization. Scopes and allowed tools are a later check. The trust-store sample is that later check for MCP. This page stops at admission.
Related
| Read | To learn how to |
|---|---|
| Google ADK | See the hook |
| API keys and M2M for Google ADK | Where the secret is allowed to live |
| Authorizing tool calls for Google ADK | What happens after the subject is known |