Securing Gemini Enterprise Agent Platform

Identity, access, and audit controls for agent interactions govern which users and agents can invoke which agents, tools, and data sources, and create a traceable record of every interaction. In the Gemini Enterprise Agent Platform (opens in a new tab), Identity and Access Management (IAM) (opens in a new tab) is the authorization system for all Google Cloud resources, while Cloud Audit Logs (opens in a new tab), Cloud Observability (opens in a new tab), and Security Command Center (opens in a new tab) provide logging, monitoring, and threat detection. Agent identity is based on service accounts, including the managed Discovery Engine Service Agent, and human access is based on IAM roles assigned under least privilege.

1.1Agent Identity and IAM Authorization Model

The Gemini Enterprise Agent Platform authorization model uses IAM to authorize every access to Google Cloud resources. Human users obtain capabilities through platform roles: the Gemini Enterprise Agent Platform User role (roles/aiplatform.user) grants access to most platform capabilities, while the Gemini Enterprise Agent Platform Administrator role (roles/aiplatform.admin) grants full control of platform resources. Additional project setup requires the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) to enable APIs, the Notebooks Administrator role (roles/notebooks.admin) plus Service Account User role (roles/iam.serviceAccountUser) for Workbench instances, and Cloud Storage and Artifact Registry permissions for artifacts such as custom training pipelines.

Agents act with their own identities rather than borrowing broad user permissions. The Identity function in Agent Platform manages agent service accounts and their permissions, and Policy Enforcement defines and applies IAM and Model Armor policies to agents. When a Gemini Enterprise app calls a custom agent, the request flows from the app to the agent endpoint using the Discovery Engine Service Agent identity, and the network path and IAM check depend on where the agent is hosted. This separation lets administrators grant an agent only the permissions needed to reach its specific tools and data sources, even when many agents share one registry.

1.2Granular Access Enforcement for Agents, Tools, and Data Sources

Granular access enforcement for agents applies least privilege to users, agents, and tool invocations across hosting platforms. For users, IAM roles should be granted to a developer or operator group rather than to individual users, because individual assignments increase management and auditing complexity, and group membership itself is managed in the existing identity provider. Authentication requires accounts managed by Cloud Identity, Google Workspace, or a federated identity provider, hardened with single sign-on, 2-step verification, and enforced password requirements.

For agent-to-agent and app-to-agent calls, authorization depends on the hosting target registered in the discovery service. When a user references @agent_name or the assistant delegates, the Gemini Enterprise app looks up the agent name in the registry to find the Agent Runtime resource URI or Agent-to-Agent (A2A) agent URL, then invokes that endpoint with the Discovery Engine Service Agent identity.

1.3Admin Surfaces and Separation of Duties

Admin surfaces for agent governance separate platform policy, application membership, and Workspace data control into three consoles. Agent Platform is the central console for platform and security administrators to govern the full agent lifecycle, including Agent Registry, Agent Gateway Management, Policy Enforcement, Observability, Identity, Security, and Audit Logging. Gemini Enterprise Admin controls licenses, instances, data connectors, attachment to Agent Gateway for routing, and which agents and tools from the registry are added to an instance, including bring-your-own Model Context Protocol (MCP) and A2A agents. The Google Workspace Admin Console controls whether the Gemini Enterprise service is enabled for Workspace users, Workspace user permissions for agents, and Workspace domain policies on agent data access.

This division creates trust boundaries between infrastructure policy and data access. Agent Platform policy determines whether an agent identity can be invoked and what Google Cloud resources it can reach, while Workspace policy determines whether that agent can read or act on Workspace services and data for a given user. Gemini Enterprise Admin bridges the two by managing user permissions for agents and directing administrators to Agent Platform for policy enforcement and deeper observability.

1.4Logging, Observability, and Audit Trail for Agent Interactions

The audit trail for agent interactions combines platform audit logs, workload telemetry, and data-access transparency. Audit Logging in Agent Platform tracks agent activities, including administrative changes and access events, and Gemini Enterprise supports audit logging plus Access Transparency for visibility into Google access. The Cloud Observability suite of Cloud Trace, Cloud Logging, Cloud Monitoring, and Topology collects traces, logs, and metrics by default for agents deployed with the Agent Development Kit (ADK), using OpenTelemetry protocols to collect execution paths, events and errors, and latency and token usage from Agent Platform, Agent Gateway, and Model Armor.

This unified telemetry supports forensic analysis of agent behavior across systems. Traces show the full path of an agent reasoning chain from user chat to Gemini Enterprise app to registry lookup to tool invocation, logs record failures and policy decisions, and metrics expose cost and performance anomalies. Google Workspace Audit Logging records agent interactions with Workspace services and data, and Workforce Identity Federation audit logs should be integrated into a security monitoring solution such as a security information and event management (SIEM) system to detect changes to attribute mappings or unauthorized access attempts.

1.5Threat Detection and Privileged Access Monitoring

Threat detection for agent workloads depends on Security Command Center integration and tight control of identity federation administration. The Security function in Agent Platform integrates findings with Security Command Center for threat detection, so anomalous agent activity, suspicious invocation patterns, and misconfigurations surface alongside other cloud findings. Compliance Manager in Security Command Center Premium can then be used to audit the environment against frameworks such as FedRAMP Low 20x.

Privileged federation roles require special monitoring because they can alter identity trust. The IAM Workforce Identity Pool Admin role (roles/iam.workforcePoolAdmin) and IAM Workforce Pool Editor role (roles/iam.workforcePoolEditor) can modify workforce pool attribute mappings, where an incorrect change can enable user impersonation and lead to unauthorized document access and actions. These roles must be granted only to trusted administrators who absolutely require them, managed through Privileged Access Manager entitlements with auditing, and monitored through federated audit logs to alert quickly on mapping changes.

Secure agent infrastructure and network architecture is the isolation of training and runtime environments inside private network boundaries with controlled paths for required traffic. On the Gemini Enterprise Agent Platform (opens in a new tab), this isolation is built with dedicated projects and Virtual Private Cloud networks, private connectivity for training and prediction, firewall rules that deny by default, and perimeters that govern data movement. Google secures the underlying physical infrastructure, network, and platform, while the customer is responsible for configuring services, managing access, securing applications, and monitoring for incidents.

2.1Shared Responsibility for Agent Infrastructure

The shared responsibility model for the Gemini Enterprise Agent Platform divides infrastructure work between Google and the customer. Google protects data center physical security, network security, and application security, secures the platform through access controls and incident monitoring and response, and maintains compliance with data protection laws. The customer configures services to use the latest platform containers and virtual machine (VM) images, manages user authentication and authorization, secures custom applications with secure coding and vulnerability testing, monitors applications and reports incidents, and meets business-specific legal requirements.

This division means network isolation is a customer configuration task on top of Google-provided controls. Google provides the VPC, firewall, perimeter, logging, and private connectivity tools, but prevention of exfiltration and unauthorized access depends on how the customer places training, runtime, data, and model endpoints inside boundaries and rules.

2.2Isolate Training and Runtime Environments

Isolated training and runtime environments are dedicated projects, VPC networks, and hardened compute that prevent unauthorized manipulation of code, data, and models. Isolation mitigates model tampering, protects training data from privacy violations, maintains service uptime, maintains regulatory compliance, and builds user trust. To obtain this isolation, run training on managed services such as Cloud Run, Google Kubernetes Engine (GKE), Managed Service for Apache Spark, or Agent Platform serverless training, and place sensitive training in dedicated projects or VPCs.

Compute hardening and workload separation further reduce the blast radius of a compromise:

• Use Shielded VMs (opens in a new tab) or Confidential Computing to protect sensitive data and code during execution in training workloads.
• Use trusted and verified container images for GKE training, scan images with Artifact Analysis, and follow GKE security best practices for network policies, pod security, and access controls.
• Use GKE Sandbox, workload isolation, Container-Optimized OS, and Cloud Run execution-environment runtime protections to contain container escapes and separate workloads.
• Use Model Registry for versioned, access-controlled model artifacts and restrict Model Garden access by user role.

For network-level isolation of compute, training jobs must not be exposed to public traffic. Custom training jobs communicate privately with authorized Google Cloud services through a Private Service Connect interface, and connections to training jobs use a private IP address for increased security and lower latency than a public IP address. Production VM instances must not carry public IP addresses, and stopped instances must not have network paths that would permit external access.

2.3Control Network Boundaries with Firewalls and Perimeters

Network boundary control for agents combines VPC firewall rules that filter traffic with VPC Service Controls (opens in a new tab) perimeters that contain data movement. Firewall policy starts from deny-all by default and then explicitly allows only traffic that meets defined criteria for source, destination, port, and protocol. VPC Service Controls creates a security boundary around artificial intelligence (AI) and machine learning (ML) resources and sensitive data inside the VPC, and ingress and egress rules on the perimeter control which data flows are permitted to cross it.

Traffic from agent environments to Google services and model endpoints stays inside these boundaries through private paths. Data flows from custom training jobs to authorized Google Cloud services through the Private Service Connect interface without traversing the public internet. Data flows from clients inside a VPC network to models through private prediction endpoints protected by a VPC Service Controls perimeter, which prevents exfiltration by governing access to the underlying models. Online prediction uses Private Service Connect for this private endpoint access.

Boundary verification also includes continuous visibility and least-exposure checks. Enable VPC Flow Logs and Cloud Audit Logs for endpoint creation, model deployment, and configuration updates, verify Secure Sockets Layer (SSL) and HTTPS enforcement, provide network address translation (NAT) for instances without public IPs, avoid use of the Compute Engine default service account, and verify GKE network policy with Dataplane V2. Firewall verification confirms that high-risk database, directory, management, mail, and remote-access ports are blocked except for explicitly approved exceptions, including Cassandra, Elasticsearch, MongoDB, MySQL, PostgreSQL, Redis, OracleDB, Lightweight Directory Access Protocol (LDAP), Server Message Block (SMB), NetBIOS, Domain Name System (DNS), File Transfer Protocol (FTP), HTTP, POP3, SMTP, Telnet, SSH, RDP, CiscoSecure/WebSM, and Memcached ports.

2.4Secure External Tool and API Connectivity

Secure external and tool connectivity for agents encrypts traffic in transit, authenticates callers, and keeps inference and integration traffic off public paths where possible. All application programming interface (API) calls to AI services use HTTPS, and HTTPS load balancers enforce HTTPS for applications and APIs. Model APIs are fronted by Apigee (opens in a new tab) or API Gateway with API keys, authentication, authorization, and rate limiting to prevent abuse and insecure direct access.

Choose private endpoints with a predefined model input and output schema when the goal is to limit inference to trusted VPC callers and block data movement outside the perimeter. Choose Apigee or API Gateway plus HTTPS load balancers when tools, clients, or partner systems outside the VPC must call model APIs in a controlled, authenticated, and rate-limited way. In both cases, audit logging of API and administrative actions records who accessed or modified data and models and when, which supports investigation of unauthorized access attempts. Compliance Manager (opens in a new tab) findings can then be used to check these controls against compliance frameworks.

Data governance and protection for AI workflows is the practice of classifying, encrypting, retaining, and confining training data, prompts, and model outputs so sensitive information is not exposed or moved outside approved boundaries. On the Gemini Enterprise Agent Platform (opens in a new tab), classification and de-identification depend on Sensitive Data Protection, encryption control depends on Cloud Key Management Service, and residency and exfiltration control depend on data location commitments plus VPC Service Controls perimeters. Governance is completed by cataloging, lineage tracking, and audit logging that record what data was used, how it was transformed, and who accessed it.

3.1Classify Training Data, Prompts, and Outputs with Sensitive Data Protection

Sensitive Data Protection (opens in a new tab) is the service that discovers, classifies, and de-identifies sensitive data in AI datasets, prompts, and outputs. Discovery scans Gemini Enterprise Agent Platform datasets at the organization, folder, or project level and writes data profiles to BigQuery, where teams analyze findings and then label dataset sensitivity to prevent personally identifiable information (PII) from entering training. For live generative workloads, Data Loss Prevention (DLP) filters for Gemini on Agent Platform screen prompts and responses for sensitive data leakage and support custom block lists.

When sensitive data must remain usable for training, Sensitive Data Protection preserves utility through transformation methods rather than raw removal:

• Pseudonymization replaces direct identifiers with reversible tokens or surrogates.
• De-identification removes or masks PII while keeping analytical structure.
• Generalization such as bucketing reduces precision, for example grouping exact ages into ranges.

Transformed data then flows from Cloud Storage or BigQuery sources into labeling and training jobs, while logging pipelines use Logging with Sensitive Data Protection to hide sensitive values before they are written to experiment logs or pipeline logs. Teams must not log PII or confidential data in experiments or distributed log servers, because logs expand the exposure surface for prompts and outputs.

3.2Protect Data at Rest and in Transit with Cloud KMS

Cloud Key Management Service (Cloud KMS) (opens in a new tab) provides customer-managed encryption keys (CMEKs) that give customers control over the keys that encrypt AI data at rest. When CMEK is configured, the CMEK-integrated service encrypts stored training data, prompts, and model artifacts for the customer, while Google still manages the underlying encryption operations. For data in transit, all API calls to AI and ML services use HTTPS, and HTTPS load balancers enforce encrypted transport for applications and APIs.

CMEK protection applies across the storage services that feed AI workflows:

• Gemini Enterprise Agent Platform for training jobs, datasets, and model artifacts
• Cloud Storage for objects, buckets, and model files
• BigQuery for datasets, tables, and data profiles
• Cloud SQL for relational training metadata
• Spanner for globally distributed structured data

Data flows from the customer-managed key in Cloud KMS to each integrated service, and each service depends on that key to decrypt data at rest for authorized use. If the key is revoked or destroyed, the dependent data becomes unreadable, which enforces cryptographic control over retention and access. For keys managed on customer servers, server-side encryption in Cloud Storage adds protection for the stored keys even if the external key storage system is compromised.

3.3Apply Minimization and Lifecycle Policies to AI Data

Data minimization and lifecycle policy limit how much sensitive data exists and how long it persists across the AI lifecycle. Minimization means not collecting, keeping, or using data beyond what business goals strictly require, and where possible using synthetic or fully anonymized data instead of customer PII. Collecting unnecessary PII increases privacy risk and can produce biased models when sensitive attributes or unrepresentative samples shape training.

Lifecycle enforcement depends on Cloud Storage (opens in a new tab) lifecycle controls, which automatically transition or delete objects after defined conditions such as age or version state. The lifecycle policy applies to training datasets, intermediate artifacts, and stored prompts and outputs, so prolonged access or manipulation of stale sensitive files is reduced. An Agent Platform data labeling job can then enrich only the retained, minimized data with structured tags that improve specificity and reduce ambiguity for model training.

3.4Enforce Residency and Sovereignty with Location Commitments and VPC-SC

Data residency and sovereignty for AI workloads combine at-rest location commitments with network perimeters that block unauthorized data movement. Gemini Enterprise Agent Platform supports data residency at rest, CMEK, VPC-SC, and Access Transparency (AXT), but support varies for related features and generative capabilities. VPC Service Controls creates a service perimeter around AI resources and sensitive data stores, and traffic that crosses the perimeter is evaluated against configured ingress and egress rules.

The available controls differ by machine learning feature:

Because the perimeter boundary sits between trusted Google Cloud resources inside and external networks and unauthorized projects outside, teams include AI resources and sensitive data inside the perimeter and deny all firewall traffic by default, explicitly allowing only traffic that meets defined criteria. Private endpoints based on Private Service Connect keep prediction traffic within the Virtual Private Cloud (VPC) network instead of traversing public IPs, while firewall policies and private IP training jobs further restrict inbound and outbound paths. For controlled sharing across privacy boundaries, BigQuery sharing, BigQuery data clean rooms, and Looker Action Hub move data through governed frameworks rather than open export.

3.5Govern and Monitor Data Flows with Catalog, Lineage, and Audit

Knowledge Catalog (opens in a new tab) (Dataplex) is the organization-wide or department-wide governance platform that centrally discovers, manages, monitors, and governs data and AI artifacts. The catalog connects data sources, transformations, and model artifacts so stewards can trace how training data flows from ingestion through preprocessing into models and predictions. Central governance depends on consistent metadata, lineage records, and access logs from each pipeline stage.

Knowledge Catalog supports five governance functions for AI data:

• Manage data lineage, with column-level lineage available from BigQuery.
• Manage data quality checks and data profiles.
• Manage data discovery, exploration, and processing across data marts.
• Manage feature metadata and model artifacts.
• Create a business glossary to standardize vocabulary and metadata.

Lineage and accountability are completed by Agent Platform ML Metadata, which logs data sources, transformations, model parameters, and experiment results for automatically encrypted artifacts, and by Model Registry, which versions each stored model. Cloud Audit Logs for Agent Platform record API calls and administrative actions, and analysis with Observability Analytics shows who accessed or modified data and models and when, with options to route logs to third-party destinations. Together, the catalog, metadata store, and audit trail let teams debug pipeline artifacts, investigate unauthorized access, and demonstrate compliance for training data, prompts, and outputs.

Key Facts

• The Discovery Engine Service Agent is the invocation identity for custom agents, and custom agents on Cloud Run require Cloud Run Invoker on that identity while custom agents on Agent Runtime require no extra invoker grant.
• IAM Workforce Identity Pool Admin and Workforce Pool Editor can modify attribute mappings to enable impersonation and must be controlled with Privileged Access Manager and federated audit log monitoring.
• Custom training jobs communicate privately with authorized Google Cloud services through Private Service Connect, and clients reach models through private prediction endpoints protected by a VPC Service Controls perimeter.
• If a customer-managed encryption key in Cloud KMS is revoked or destroyed, the dependent AI data encrypted with that key becomes unreadable.
• Only Gemini Enterprise Agent Platform supports all four controls of data residency at rest, CMEK, VPC-SC, and Access Transparency; RAG Engine supports only VPC-SC.