`before_agent_callback` returns content and skips the agent when the bearer is missing or userinfo rejects it. Returning `None` is the only path into the agent body.

Getting started, including the planned sample, is [Google ADK](/docs/agent-frameworks/adk).

## What fails closed

A callback with no token, or a token userinfo rejects, returns content whose text is `unauthorized`. The agent body does not run.

A callback with a bearer userinfo accepts stores the subject and returns `None`.

A resolved subject is not authorization. Scopes and allowed tools are a later check. The [trust-store sample](https://github.com/authdog/agents-samples/tree/main/trust-store/python) is that later check for MCP. This page stops at admission.

## Related

| Read | To learn how to |
| --- | --- |
| [Google ADK](/docs/agent-frameworks/adk) | See the hook |
| [API keys and M2M for Google ADK](/docs/ai/adk/api-keys-and-m2m) | Where the secret is allowed to live |
| [Authorizing tool calls for Google ADK](/docs/ai/adk/authorize-tool-calls) | What happens after the subject is known |