Google Gemini Enterprise

Google Gemini Enterprise: a governed home for many agents, with the build left to the customer

A pilot that stalled inside a Google Workspace company often stalled for a reason Gemini Enterprise is designed to address: the security team could not see, identify or contain the agent once it started acting. On Google's own description the product folds an agentic platform, an AI assistant and search across the company intranet into a single offer¹, and its FAQ pitches the app as an advanced agentic platform that carries the best of Google's AI to each person on the payroll². Budget holders should know the offer comes in two pieces, the app on one side and Agent Platform on the other, and each has to be purchased on its own³, and Google presents the Agent Platform as the next stage in the development of Vertex AI⁴.

This site places Gemini Enterprise third. Its governance layer for agents in production is among the most detailed reviewed here, and its certification list is long. It ranks below Nexus and Copilot Studio because the build itself rests with the customer, the editions and licenses add planning work before production, and the list price for the enterprise editions is not publicly stated on the pages we opened.

What a team actually builds with

Staff without programming skills get what the FAQ describes as a powerful no code workbench for making custom agents⁵, and Google supplies ready made agents as well: a Deep Research agent that investigates complex questions for the employee⁶, plus a Data Insights Agent offered in preview to Standard and Plus customers⁷. Teams with engineers can go further, because customers on Standard or Plus are able to take agents written on Agent Platform or with the Agent Development Kit and publish them straight into the Gemini Enterprise app⁸, and agents built outside Google's tools can be brought in over A2A, the Agent to Agent protocol⁹. For research and synthesis work, Gemini Notebook Enterprise sits beside the main product as an AI powered assistant for summarizing knowledge¹⁰.

For a stalled pilot this spread matters in both directions. A business team can rebuild a simple assistant quickly in the workbench, while an engineering team can bring a more ambitious agent built elsewhere into the same governed catalog. Neither route, on the pages we opened, includes a Google team that does the building.

Governing agents once they act

This is where Gemini Enterprise is strongest for a sponsor whose pilot was blocked by security. The FAQ describes the app as one pane of glass through which an organization governs every agent across all of its teams¹¹. Underneath, Agent Platform issues each agent a SPIFFE ID, a unique and secure identifier that a security team can track¹², and Context Aware Access guards those identities by default from the moment they exist¹³. Traffic into and out of agents passes through Agent Gateway, which Google calls the main point of entry and exit¹⁴, while Model Armor inspects user prompts and the responses that tools return, in real time, so that prompt injection can be blocked¹⁵; every edition of the app includes Model Armor¹⁶. Rules about how an agent may use its tools are written in plain language¹⁷, which lets a risk owner read the policy without a developer translating it.

Access to the platform follows enterprise patterns. Enterprise administrators manage Standard and Plus with three tools, namely source system ACLs, IAM, and Workforce Identity Federation, which supplies SSO¹⁸, and Cloud Identity and Access Management limits who may get in to provisioned users and admins¹⁹. Document level access controls are enforced so that answers do not leak content to the wrong person²⁰, and search across company information honors each user's permissions²¹. Because allowances are shared, an administrator worried that one enthusiastic user could exhaust them may impose a consumption limit on each individual²². The Business edition is simpler to run: its admins control membership and connector access for the team²³, and the editions page notes that there are neither project numbers nor IAM roles at project level for them to look after²⁴.

Getting to a licensed production deployment

The licensing model is the first piece of real work on the path to production. The sequence Google documents starts with a subscription to one edition, purchased against a billing account²⁵, after which the administrator allocates the licenses it contains to chosen projects and locations²⁶. That allocation is binding, since a license is tied to a single combination of Google Cloud project and location²⁷ while the subscription itself is tied to its billing account²⁸; assignment to users can then be manual or automatic²⁹. Seat subscriptions come in monthly and annual terms³⁰, the console automatically limits the number of seats one subscription can carry³¹, and no user can receive a license until IAM has granted them the Gemini Enterprise User role as a minimum³².

None of this is unusual for a cloud service, but a sponsor planning a go live date should allow time for it, particularly where the pilot ran under one project and production will run under another. Smaller teams have a lighter path: the Business edition is opened with a work email address³³, lives entirely in the browser as software delivered from business.gemini.google³⁴, and is documented in a support center of its own, apart from the main docs that serve the other editions³⁵.

How far the connectors reach

The connectors are oriented toward collaboration and knowledge. Out of the box the product includes connectors for popular applications made by other vendors³⁶, and the documentation gives ServiceNow, Microsoft SharePoint, Jira and Confluence as examples³⁷. Connectors for Google Workspace sync Gmail, Drive, Calendar and Groups as changes happen³⁸, and the Business edition links to HubSpot, Notion, Microsoft 365 and Google Workspace³⁹. For analytics data the Data Cloud family includes a federated BigQuery connector⁴⁰, and running it in federated query mode leaves the data in its existing store⁴¹, which avoids copying regulated tables into yet another system. Where a specialist agent already exists, a team can look for one built by a Google partner in Agent Marketplace before writing its own⁴².

Two connector details belong on the production checklist. The first is that, per the security overview, any connector to a non Google application communicates with public endpoints beyond Google's network⁴³; Google's recommendation for authenticating those connectors is Workforce Identity Federation⁴⁴. Customers running VPC Service Controls must permit Data Cloud connectors through a specific organization policy constraint⁴⁵, and until that constraint allows the connector, creation of the data store is blocked⁴⁶.

Security file and data location

For a security reviewer the certification page is a strong opening document. Its scope is the Standard and Plus editions together with Notebook Enterprise⁴⁷, and among the frameworks it lists are SOC 1, SOC 2 and SOC 3, PCI DSS, HIPAA, ISO 27001 and FedRAMP⁴⁸, which covers most of what a health, payments or public sector reviewer will ask about first. Key control is unusually flexible for a SaaS product. The security overview lists CMEK support⁴⁹, which Standard and Plus implement with Cloud Key Management Service⁵⁰, and customers who want keys held outside Google can use EKM or HSM options⁵¹. Audit evidence is covered as well, because the enterprise editions write Cloud Audit Logs and support Access Transparency, the record of Google's own access⁵².

Data location is configurable. Three residency settings appear in the editions table, global, eu and us⁵³, and for the two larger editions the FAQ undertakes to help hold a customer's data in its chosen region⁵⁴. Inside whichever location is chosen, a production deployment keeps its records separated off in the Google Cloud project that the customer owns⁵⁵. There is a catch for anyone choosing the default: customer managed keys and Access Transparency are both unavailable once data sits in the global region⁵⁶, so a production deployment that needs them has to be placed in us or eu from the outset.

Training and retention terms are clear. Google states that nothing a customer types, receives or connects is used to train its foundation models⁵⁷, a point the editions page draws as a contrast with consumer Gemini⁵⁸, and Business edition prompts and outputs are likewise kept out of training for Google's models or any other customer's⁵⁹. On Agent Platform the commitment is that customer data will only be used to train or fine tune an AI model if the customer has given permission or instruction first⁶⁰, customer data for Models as a Service is retained for limited periods⁶¹, request and response logging is switched off by default⁶², and stored logs for grounding with Google Search are kept for up to three days⁶³. If a user asks Google to delete their data, the security overview commits Gemini Enterprise to doing so inside sixty days⁶⁴. For data that should never reach an agent at all, Sensitive Data Protection can block sensitive material at the connector before it is ingested or indexed⁶⁵; it is available across the editions⁶⁶ and supports three multi regions, global, EU and US⁶⁷.

Limits a production sponsor should test

The most important limit for a regulated buyer is architectural. Because Gemini Enterprise is a SaaS product, customers cannot apply custom network controls of their own to it⁶⁸, which may matter to a security team that expected to wrap the agent in its own perimeter.

Usage quotas need checking against real demand. Google's quota table allots every Standard license 160 Assistant queries and five images per day⁶⁹, and the quota page's Plus example works from 200 queries a day for every license⁷⁰; a sponsor should model peak demand against those numbers before announcing a go live. Pooling softens the per license figures, since feature quotas other than storage and indexing are shared by everyone on an edition⁷¹, and the storage and indexing allowances are in turn pooled across every edition that sits in one project and location⁷². The data protection layer has blind spots worth testing with real content. A pilot that indexed websites or kept its source data in BigQuery or Cloud Storage under the older data store type will find the content policies do not reach those stores⁷³, and if the pilot's documents are encrypted Microsoft files, the scan for violations skips them⁷⁴. Finally, any business case that leaned on the Gemini Code Assist rights bundled into current Standard and Plus subscriptions needs revisiting, because the release notes give March 31, 2027 as their end date⁷⁵.

What it costs to run in production

Costs are only partly published. The one published price is for the Business edition, from $21 for each seat every month⁷⁶, an edition Google pitches at smaller companies and at teams with no more than 300 people⁷⁷. The step up to the larger editions is where a production program usually lands, and the FAQ lists what it buys: Gemini Code Assist, access to agents from third parties, a bigger quota and no ceiling on seats⁷⁸. Either of those editions can then add Frontline, which Google tailors to frontline workers^79,80. For finance teams the app behaves like other seat based software, invoiced every month by the number of seats and requiring a live license for each person who uses it⁸¹. Agent Platform follows a different logic, charging by consumption⁸²; the release notes say pay as you go subscriptions involve no license fee⁸³, the customer settles each month for actual use⁸⁴, and calls to partner models are metered in that same way⁸⁵. Two smaller billing notes round this out: prepaid credits have reached general availability for accounts billed online without a sales contract⁸⁶, and the research companion, Notebook Enterprise, is sold by subscription with a ceiling of 5,000 licenses⁸⁷.

The figure most enterprise buyers need is missing. What a seat on Standard or Plus actually costs is not publicly stated on the pages we opened, because the pricing URL served a not found message on the day we checked⁸⁸, so an enterprise sponsor has to go through sales to build the production budget. Trials, by contrast, are easy to start. A month of Standard or Plus is free⁸⁹, the landing page lets a team run Plus for thirty days with no salesperson involved⁹⁰, and Business has its own thirty day trial at no charge⁹¹. A ministry or a university sponsoring a pilot will be pointed to a version tailored to the sector, of which Gemini for Government is the example Google gives⁹².

The buyers Google has in mind

Google's FAQ has office based knowledge staff in mind as the main users, listing departments from finance and HR through marketing and sales to IT and engineering⁹³, which suits assistant style pilots better than ones that execute transactions. Its examples lean toward knowledge work: one sample prompt asks for the previous year's top campaigns to be summarized⁹⁴, and the Business page adds bringing new employees up to speed through Gemini Notebook⁹⁵, writing customer messages informed by Google Search⁹⁶, and automating purchase orders while keeping track of stock⁹⁷. A Google delivery team that takes a stalled pilot and builds it into production for the customer is not publicly stated on the pages we opened.

Verdict for a team with a stalled pilot

Gemini Enterprise ranks third because it gives a security team more of what it needs to approve agents in production than most platforms here: an identity for each agent¹², a gateway for agent traffic¹⁴, Model Armor in every edition¹⁶, plain language tool rules¹⁷, regional data residency⁵³ and a broad certification list⁴⁸. For an organization already standardized on Google Cloud and Workspace, it is a natural place to bring scattered pilots under one governed roof¹¹.

It sits below Nexus and Copilot Studio for this buyer because the customer still does the building, the license setup by project and location^26,27 has to be planned into the go live date, custom network controls are not available⁶⁸, and enterprise edition prices are not publicly stated on the pages we opened⁸⁸. A sponsor with Google Cloud engineers on staff can finish a stalled pilot here; one without them will need a partner alongside the platform.