Google Cloud governance · AI Governance

08Google Cloud governance

The governance problem first — then the products that answer it.

Google's posture in one line: publish the frameworks (AI Principles, Frontier Safety Framework, SAIF 2.0), then ship governance as configurable platform primitives — allowlists in the resource hierarchy, screening floors in the request path, identity down to individual agents — under a “shared fate” posture with contractual commitments: no training on your data without permission, and IP indemnification for covered generative services.

Naming update sellers must get right (2025–2026)

Say this now	Formerly
Gemini Enterprise Agent Platform	Vertex AI (the builder platform; APIs unchanged)
Gemini Enterprise	Agentspace (the employee-facing agent workplace)
Agent Runtime	Vertex AI Agent Engine
Agent Search	Vertex AI Search
Knowledge Catalog	Dataplex Universal Catalog

Two brands are easily confused: Gemini Enterprise is what employees use; the Agent Platform is what builders use. Customers' internal runbooks referencing old names need an update pass — a genuine consulting opening.

The capability map

Every capability, mapped to the layer it governs.

Filter by layer. Each card names the governance problem the capability solves — not just what it is — with its status and a link to official documentation.

Filter by layer to see which capabilities answer which governance question. Cards link to official docs.

Model Garden

Gemini Enterprise Agent Platform (formerly Vertex AI)

Curated catalog of 200+ Google, open, and partner models.

One vetted front door for model supply instead of ungoverned model sprawl.

Model allowlisting (org policy)

Organization Policy

vertexai.allowedGenAIModels restricts which models any project may call.

Central model approval enforced preventively across the resource hierarchy.

Model Registry

Gemini Enterprise Agent Platform

Central inventory of customer models: versions, aliases, lineage.

Version control and audit trail for first-party and tuned models.

Version pinning & retirement policy

Gemini models

Pinned stable versions with published retirement dates.

Managed change control against silent provider model churn.

Gen AI evaluation service

Gemini Enterprise Agent Platform

Computation and LLM-as-judge metrics for models, apps, and agents.

Documented pre-deployment quality gates and regression evidence.

Agent evaluation & simulation

Preview

Gemini Enterprise Agent Platform

Multi-turn autoraters, live-traffic evals, pre-deploy simulation.

Continuous quality governance for agent behavior, not just model output.

Model Armor

Security

Model-agnostic screening of prompts and responses, with org-wide floor settings.

Prompt injection, jailbreaks, sensitive-data leakage, and unsafe content — one policy over any model.

456

Gemini safety filters

Gemini models

Configurable harm-category thresholds plus non-configurable core filters.

Baseline content safety per request, tunable per use case.

Grounding with Google Search & your data

Gemini Enterprise Agent Platform

Citation-bearing answers grounded in Search or approved corpora.

Hallucination reduction with attributable, checkable sources.

Agent Search (formerly Vertex AI Search)

Gemini Enterprise Agent Platform

Enterprise RAG with ACL-aware retrieval and grounded generation.

Answers constrained to approved documents, honoring existing permissions.

Apigee as AI gateway

Apigee

Token quotas, semantic caching, model routing, Model Armor policies inline.

One governed front door for every model consumer — including non-Google models.

AI/ML Privacy Commitment

Contractual

Customer data is not used to train Google models without permission.

The first procurement blocker, answered contractually rather than by policy blog.

Sensitive Data Protection (Cloud DLP)

Security

Discovery, classification, and de-identification across 150+ infotypes.

PII/PHI kept out of training data, prompts, responses, and logs.

VPC Service Controls

Security

Service perimeters around AI APIs block exfiltration paths.

Keeps AI workloads inside a data perimeter, including partner-model calls.

Customer-managed encryption keys

Security

Customer key custody over platform resources, tuning artifacts, agent state.

Key control and crypto-shredding for regulated and sovereign workloads.

Data residency & zero-data-retention

Gemini Enterprise Agent Platform

Regional endpoints for in-region processing; ZDR by disabling the 24h cache.

Residency and retention posture as explicit configuration, per model.

Knowledge Catalog (formerly Dataplex Universal Catalog)

Data governance

Unified catalog and automatic lineage across data and AI assets.

The map auditors ask for: which data trained which model behind which decision.

Access Transparency & Access Approval

Security

Logs — and approval gates — for Google-personnel access to customer content.

Provider-insider assurance regulators increasingly ask about.

Security Command Center AI Protection

Security Command Center

AI inventory discovery, virtual red teaming, AI/agent threat detection.

AI security posture management — including shadow AI inside your cloud.

IAM & workload identity

Identity

Least-privilege roles for models, endpoints, tuning, and agents.

Who may build, deploy, call, and administer AI — enforced, not documented.

Cloud Audit Logs + request-response logging

Observability

Immutable admin logs; opt-in data-access and prompt/response logging.

Forensic trail for AI usage — with content logging as a deliberate choice.

OpenTelemetry GenAI observability

Observability

Standardized traces for model calls, tool calls, and agent reasoning.

Vendor-neutral audit and telemetry format across the AI estate.

Budgets, quotas & Provisioned Throughput

FinOps

Billing budgets, dynamic shared quota, reserved generative throughput.

Cost governance for AI — runaway spend is a governance failure too.

Agent Development Kit (ADK)

Agent stack

Open-source agent framework, auto-instrumented with OTel.

Standardized, observable agent construction instead of bespoke loops.

Open standard

Linux Foundation agent-interop standard; v1.0 with signed Agent Cards.

Cross-vendor agent discovery, identity, and communication without lock-in.

Agent Payments Protocol (AP2)

Generative AI indemnification

Contractual

Two-pronged IP indemnity: training data and generated output.

Shifts copyright-infringement risk for covered services to Google.

How it fits together

Four reference architectures.

The capabilities compose into four repeatable shapes. Each is anchored to a public customer pattern from the examples library.

R1Rolling AI out to the whole workforce without feeding shadow AI

Governed employee AI

Workspace AI controls per OU → label/IRM exclusions keep crown jewels out of retrieval → context-aware access gates AI surfaces by device → Gemini Enterprise as the governed agent storefront with admin allowlists → Chrome Enterprise Premium coaches or blocks paste/upload to unsanctioned AI → usage audit logs to Cloud Logging.

The Macquarie pattern: training-gated, bank-wide rollout on an already-governed foundation.

R2Customer-facing or high-stakes apps on the Agent Platform

Governed custom application

Org-policy model allowlist pins approved models → VPC-SC perimeter + CMEK + regional endpoints set the data envelope → Model Armor floor guarantees screening; advanced Sensitive Data Protection de-identifies both directions and the logs → Gen AI evaluation gates every prompt/model change in CI → Data Access audit logs + opt-in redacted request/response logging → Provisioned Throughput reserves production capacity.

The Deutsche Bank / Commerzbank shape: evals as the compliance artifact, prompts logged and queryable.

R3Agents that act on systems, data, and money

Governed agent fleet

Agents built in ADK (OTel-instrumented) → evaluated and simulated pre-deploy → run in Agent Runtime with CMEK-protected Sessions/Memory Bank → each holds a SPIFFE-based Agent Identity mapped to IAM → every tool/MCP call traverses the Agent Gateway with Model Armor inline → untrusted code executes in the gVisor Agent Sandbox → Agent Registry is the inventory and kill switch → SCC AI Protection watches posture, anomalies, and attack paths.

SAIF 2.0's three agent principles rendered as products: human controllers, limited powers, observable actions.

R4Enterprises running Gemini alongside OpenAI, Anthropic, and self-hosted models

AI gateway over a multi-vendor estate

Apigee as the single AI front door: per-consumer token quotas, semantic caching, model routing/failover, analytics for chargeback → Model Armor invoked as a gateway policy so injection/leakage screening is uniform across providers → the load balancer chains Cloud Armor and Service Extensions so even non-Apigee traffic (agents, MCP) gets screened → SCC watches the whole estate.

The Goldman/Walmart pattern with managed parts: governance written once at the gateway, inherited by every app.

Credibility section

Honest gaps and shared responsibility.

A governance story earns trust by naming its own limits. These are the ones to say before the customer finds them.

GenAI drift monitoring is not a turnkey product — Model Monitoring covers predictive models; for LLMs you assemble continuous evaluation plus dashboards.
Model allowlisting governs Model Garden models, not arbitrary self-hosted weights on GKE/GCE — open weights are deliberately outside the control plane.
Gemini's native safety filters do not apply to partner models (Claude, Llama). The cross-model control is Model Armor — position it that way, and note it adds latency and, for advanced inspection, cost.
Audit logs never contain prompts. Content-level audit means deliberately enabling request-response logging — then you own retention, access, and PII handling (mitigate with SDP redaction).
Caching is on by default; zero data retention is a configuration, not a default. Verify per-service terms during contracting.
Residency can lag the frontier: the newest Gemini versions often launch on the global endpoint first. Never promise regional processing without the per-model matrix.
Model retirements are aggressive (~6 months after a successor). Version pinning is temporary; a migration runbook is a governance cost of the platform.
EU AI Act conformity stays with the deployer: Google supplies certifications, logging, and evidence tooling — risk classification, impact assessments, and oversight design are the customer's.
The agent governance stack (Identity, Registry, Gateway, Sandbox) shipped in 2026 — expect Preview labels and evolving APIs; check status per component before proposals.

Compliance anchors (verify scope per deal)

ISO/IEC 42001

Accredited AI-management-system certification covering the platform (announced Dec 2024).

FedRAMP High

Generative AI and enterprise search authorized; Workspace Gemini also at FedRAMP High.

HIPAA (BAA)

Platform HIPAA-eligible under the Cloud BAA — with configuration duties, not by default.

EU AI Act support

Dedicated program plus Audit Manager evidence automation; conformity remains the deployer's.

Next: see it working in the examples →