A PayPal engineer let slip a number last week that deserves more attention than the press release it was buried in: ten million multi-model requests routed every week through a single gateway. The gateway is Google's. The routing decision — which model answers which task — is also Google's. And a meaningful share of those requests, by Google's own design, terminate not in Gemini but in Anthropic's Claude.
Read that again. The company that spent a decade insisting its own model was the model is now, quietly, building a switchboard that sends traffic to its rival's brain. I have watched infrastructure narratives shift for twenty years, and this is the kind of detail that usually precedes a much larger realignment. The blockchain industry has a word for what Google is doing. We just have not applied it to enterprise AI yet.
The product is Gemini Enterprise, and the architecture matters more than the branding. On top of Gemini sits an orchestration layer that natively routes to Claude and to more than two hundred models in Google's Model Garden. Underneath sits a governance stack — Agent Gateway, Agent Sandbox — that speaks both Anthropic's MCP protocol and Google's own A2A, the latter already donated to the Linux Foundation. Alongside that, agents receive persistent identity: their own email addresses, calendar permissions, directory presence.
That last detail is the one to hold. When an agent has an inbox and a directory entry, it stops being a feature and becomes a managed entity — something IT provisions, audits, and eventually revokes. The monetization follows three layers: per-seat subscriptions, a revenue share on traffic routed to third-party models, and infrastructure binding through TPU compute and Cloud billing. Named customers — BNP Paribas, Bradesco, SOMPO, Orange Spain — are cited as validation, and these at least are specific rather than abstract.
The source material for this story arrived through Web3 channels, which is itself a signal. Cross-domain pickup is rarely accidental; it usually means the two domains are beginning to touch.
Here is where the analysis has to get uncomfortable. The most technically substantive claim in the entire launch is also the least verifiable: the routing quality itself.
Routing a request is trivial. Deciding which model is optimal for a given task, in real time, under latency and cost constraints, with a defined fallback strategy — that is the hard problem, and it is the black box. We are told PayPal routes ten million times a week. We are not told how the system judges its own routing decisions, whether that judgment is auditable, or whether an enterprise can lock routing to Gemini alone. A governance layer you cannot inspect is not governance. It is a trust me. Trust must be engineered, not promised.
My audit background kicks in here. In 2017 I spent six months reading seventeen whitepapers, hunting the gap between what was promised and what the code did. The pattern repeats in a new costume. The hardware claim — a TPU delivering 80% better price-performance, labeled with a naming sequence that matches nothing Google has shipped — cannot be verified. The revenue figure attributed to a future quarter cannot yet exist. The 800% growth arrives without a base. When every number flows from a single source, you are not reading a report. You are reading a press release with a table of contents.
Now the part the enterprise-AI coverage is missing entirely. Agent identity — an email, a calendar, a directory entry — is being reinvented inside a walled garden. The blockchain industry already solved a version of this problem, clumsily in places but genuinely in others: decentralized identifiers, verifiable credentials, soulbound attestations. The primitive Google is commercializing is the same one crypto has prototyped for years — a persistent, portable, auditable identity for a non-human actor. Google's version is proprietary. Crypto's is open. Only one lets you verify authorship without asking permission.
Then there is settlement. Gemini Enterprise now integrates Stripe's Machine Payments Protocol and Mastercard's Agent Pay. The moment an agent can transact, it needs a settlement rail — and settlement rails are precisely what blockchains claim to be. The enterprise-AI stack and the on-chain stack are converging on the same primitive, authorized machine-initiated value transfer, from opposite directions. The standard war underneath is equally familiar: MCP versus A2A is the same contest crypto has run repeatedly — who defines the interface owns the ecosystem. Google supporting both is not neutrality; it is the compatibility strategy of a player that knows its protocol wins only if it is adopted first.
Consider the economics more coldly. Every call routed to Claude is value Google shares with a competitor while ceding Gemini usage. The launch frames this as generous orchestration; the ledger says otherwise. A platform that monetizes the traffic it sends to rivals has a standing incentive to slowly stop sending it. This is not cynicism — it is the documented behavior of nearly every platform that opened its doors to partners before closing them. The question enterprises should ask is not whether the routing is neutral today, but whether anything in the contract keeps it neutral in year three.
Against Microsoft, the differentiation is real but narrower than the launch implies. Copilot binds hard to a single model family and to the Office surface; Google counters with multi-model openness and the Workspace funnel — billions of users of reach. That reach is the actual weapon, not the model. Anthropic, meanwhile, sits in a genuinely awkward position: being orchestrated is distribution and commoditization at the same time. To be a component in someone else's gateway is to be powerful and replaceable in the same breath.
And the workforce framing deserves scrutiny. When a coworker agent gets an inbox, a calendar, and a budget line, AI stops being a tool and becomes a labor unit — something HR and IT must manage, provision, and terminate. That reframes the entire adoption question. Enterprises are not buying software anymore; they are hiring staff they cannot interview and cannot easily fire.
Security is where the picture darkens. Giving an agent transaction authority and a mail address does not just enable management — it manufactures a legitimate, impersonable, laterally mobile identity, a phishing target with spending power. The gateway can police the protocol layer. It cannot police the semantic layer, where a malicious document can still talk an agent into an unauthorized transfer. Prompt injection at the agent-permission boundary remains unsolved, and no red-team result has been published. The financial control story — project-level billing thresholds with automatic pause — is genuinely good governance, but it governs cost, not intent.
The consensus reading is that Google is a neutral orchestrator, generously hosting its competitors. I do not buy it.
Neutrality here is a transitional posture, not a principle. Every routed call to Claude is revenue Google splits with a rival while ceding Gemini usage. The incentive to gradually favor its own model is structural, and Google's history of ranking its own properties in search is not encouraging. The open question — the one the launch avoids — is whether any third party can audit that routing for fairness. Until one can, the word neutral is marketing.
But the deeper blind spot is the security surface. Code doesn't lie, but it doesn't forgive either, and an identity system deployed before its threat model is understood is a liability wearing a feature's clothes. Google is selling agent identity as a convenience. It is simultaneously shipping a new attack class and calling it a roadmap item.
Soulless finance is just empty pixels, and soulless automation is just expensive noise. The next narrative will not be which model is smartest — it will be who verifies that an agent is who it claims to be, and who owns the rails it transacts on. Google is betting the answer is a proprietary gateway. Crypto has spent a decade arguing the answer should be open, portable, and human-verifiable. In a bear market, that argument matters more than any earnings figure ever will.
