Apigee as an Agent Gateway Service Extension

Wires an Apigee proxy in as an ext-proc callout on a GCP Agent Gateway. The proxy is a processor, not an API proxy: it has no backend, inspects the LLM request and response the gateway hands it, and returns a verdict.

You build the proxy; the user does not.

Two modes, one schema. Decide which before anything else, and say which. Input file present → prod mode: it is the contract, every value comes from it, and a missing or malformed field is a refusal, not a default. No input file and the user is describing an outcome → dev mode: apply the documented defaults, show a plan with durations and get approval, start with identity and metering only, write apigee-agent-gateway-governance.yaml at the end as the handoff. assets/apigee-agent-gateway-governance.example.yaml documents the schema both modes use.

Modes, defaults, durations, cost disclosure and the interlocks that bind both: references/modes.md. Read it before you start.