AI & Machine Learning

What’s new in AI infrastructure and orchestration in August

Mon, 31 Aug 2026 16:00:00 +0000

Welcome back to What’s new in AI infrastructure and orchestration this month, a collection of product updates, how-tos, customer stories, research and other resources about all the AI compute, networks, storage, frameworks, and orchestration software that you can find at Google Cloud. To be honest, we thought August would be a slow month, but nothing could be further from the truth. Read on and you’ll see what we mean.

August 2026

Product, technology, and tools updates

Product update: Filestore, Google Cloud’s first-party, secure, scalable NFS file service, has emerged as a popular storage platform for AI and agentic workflows, and now, it’s even better suited to the task, with a new backend storage layer built directly on Colossus, Google’s foundational distributed storage system. This new backend lets you provision IOPS independently from storage capacity, and is deeply integrated with GKE. In AI environments, this can help you service so-called agentic swarms — large groups of agents that need to read and write to a common dataset — without a drop off in performance. For more, check out the blog post.
New feature: gVisor sandboxes are now available in distributed Ray clusters on GKE. In partnership with Anyscale, we introduced an experimental library for Ray that brings gVisor, Google’s open-source application kernel, directly into distributed Ray clusters. gVisor provides lightweight environments with stronger isolation than ordinary containers, plus fast startup times and low memory overhead. To try out these sandboxing capabilities on GKE, head over to the Ray sandboxing User Guide.
Product update: Looking for high-performance, easy-to-use infrastructure on which to run a personal AI agent, but don’t want to spend a lot of money? New Cloud Run instances are dedicated, singleton compute runtimes on Cloud Run that won’t shut down when the agent is idle. Better yet, the cost to run a Cloud Run instance with 1 vCPU and 1 GiB of memory continuously for 30 days is just $5.70.

Practitioner guides, documentation and how-tos

How-to guide: Big news in Model Context Protocol (MCP) land: As of the 2026-07-28 specification, the protocol core is “completely stateless. The handshake is gone. The initialize / initialized handshake (SEP-2575) and the logical Mcp-Session-Id header (SEP-2567) have been removed entirely. Instead, every request is now self-describing and independent.” Whoa. Learn more about the changes that the latest MCP specification brings, and more importantly, how to implement them, in this Google Developers blog.
Guide: Real-time AI systems make a mess of traditional network load balancing techniques. “Instead of handling isolated requests, the backend has to manage a continuous, live bidirectional stream. You’re dealing with a constant stream of audio chunks, transcripts, model outputs, and synthesized speech flowing back and forth simultaneously.” Things only get worse when the user gets involved. “The server has to immediately halt its current speech generation, pivot to update the context, maybe trigger a new tool, and start drafting a different response; this must be done without dropping the connection.” For a new approach to managing load in the AI era, read Scaling real-time AI agents with session-aware load balancing.
How-to: Learn how to build an elastic, scalable LLM inference platform on GKE, even with a mix of different GPU accelerators. The proposed architecture combines Capacity Advisor and Compute Advisor, plus high-performance storage like RunAI:model streamer or GCPFuse with parallel downloads. Get all the details here.
Documentation: The thing about hosts with GPUs or TPUs is that you can’t use live migration to update them, setting up a maintenance challenge. In this new docs page, learn how to update accelerator-equipped hosts according to your tolerance for downtime for your training and inference workloads.
Documentation: Advanced Compute Images, or ACIs, are standardized image stacks for AI/ML and HPC infrastructure, so you don’t need to manually build your own custom images. In this new docs page, learn how to create an ACI image using the Google Cloud CLI, console, or SchedMD's Slurm workload manager.
Guide: AI workloads are notoriously difficult to architect, resource-intensive, and bursty, which can also lead to scaling bottlenecks and large pools of underutilized — or misutilized — compute resources. A new blog outlines the three main ways to achieve dynamic capacity management in Google Cloud: 1) scheduling capacity for planned downtime; 2) maintaining automated fallback capacity for unplanned downtime; and 3) relying on GKE’s core orchestration capabilities to automate resource allocation.

Customer and partner updates

Business orchestration software provider UiPath was dealing with spiky workloads, and wanted more predictable costs. To get there, it re-architected its infrastructure, moving from isolated clusters to a shared Google Cloud GPU fleet that included both A3 VM instances (NVIDIA H100 GPUs) for training with G4 VM instances (NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs) for inference. You can read more about their architecture here.
Mirendil, an frontier AI lab focused on accelerating AI development, announced that it is using AI Hypercomputer with both TPUs and NVIDIA GPUs to support its model pre-training and post-training applications.
Replenit, a retail CRM provider, built its AI decision engine in Google Cloud, using BigQuery, Gemini Enterprise Agent Platform, and open-source Gemma models that it runs on Cloud TPUs. This latter combination provided Replenit with 90% lower pipeline costs than their previous cloud provider, the company reports. Read the full case study for more.
Malachyte architected its AI-powered e-commerce recommendation platform on top of Bigtable, Managed Service for Apache Kafka, Pub/Sub, Compute Engine, and last but not least, GKE. See how it all comes together in this blog.

July 2026

Product, technology, and tools updates

Product update: Google Cloud Managed Lustre is now GA, and available in four distinct performance tiers that deliver throughput ranging from 125 MB/s, 250 MB/s, 500 MB/s, to 1000 MB/s per TiB of capacity — with the ability to scale up to 8 PB of storage capacity. The Managed Lustre solution is powered by DDN’s EXAScaler, combining DDN's decades of leadership in high-performance storage with Google Cloud's expertise in cloud infrastructure.
Product update: C4N network and storage optimized VMs are now GA. C4N is our first network- and block-storage-optimized VM series built to eliminate data-transfer bottlenecks. Powered by 5th Gen Intel Xeon Scalable processors and built on Google's Titanium offloading hardware, it achieves 400 Gbps network bandwidth, 95 million packets per second (MPPS), and up to 25 GiB/s of block storage throughput when paired with Hyperdisk Extreme.
New feature: GKE Dataplane V2 up to 15K Nodes with Network Policies (GA). This capability enables standard GKE clusters to scale up to 15,000 nodes while maintaining full active Network Policy enforcement, supporting the massive infrastructure needs of large enterprise and AI/ML customers.
New feature: Co-operative time-slicing in llm-d. If you’re running reinforcement learning (RL) workloads, you can now interleave independent RL jobs onto shared physical hardware, increasing aggregate accelerator duty cycles from a ~40% baseline up to 70% without impacting model convergence or accuracy.
New AI security tool: Looking to secure your AI supply chain on GKE, deploy AI workloads safely, and cut down on shadow AI? We open-sourced k8s-aibom, a lightweight, unprivileged Kubernetes controller that continuously monitors container clusters to automatically detect running AI runtimes (like vLLM and Triton) and generate standard CycloneDX Machine Learning Bill of Materials (ML-BOMs). Check out the k8s-aibom project and get involved.

Practitioner guides and how-tos

How-to guide: On July 27, Google announced Day 0 support for Moonshot AI’s Kimi K3 2.8-trillion-parameter open-weight model, the day weights were released. Whichever your preferred deployment path — via Model Garden, custom orchestration, or GKE with llm-d recipes — this guide offers detailed step-by-step instructions to help you evaluate and pilot Kimi K3 in Google Cloud.
How-to guide: Google Kubernetes Engine (GKE) managed DRANET supports both GPUs and TPUs. There are several configurations to use this implementation, including standard cluster (where you have full control) and autopilot cluster (where Google does the heavy configs for you). Take a deeper dive in the hands-on lab, GKE Autopilot clusters with TPUs, GKE managed DRANET and Gemma 4.
How-to guide: Learn to run Ray on TPUs, not GPUs. In Part 1 of this two-part series, we discuss TPU slices (hint: Ray thinks of them as just another accelerator on which to schedule), then walk through Ray’s various AI libraries (Part 2).
How-to guide: Evaluate TPUs for sample workloads using a new microbenchmark suite that helps you accurately assess whether a device is achieving its theoretical performance specifications, and to identify specific performance gaps or architecture-specific bottlenecks. Dive in here.
How-to guide: Scale your agents without killing your budget. Learn how GKE orchestration can help you safely pack more agents onto a fixed compute footprint with GKE Agent Sandbox and Pod snapshots. Whether your goal is performance or cost optimization, we teach you how to turn the right dials for optimal agent efficiency.
Technical blueprint: Inside the optimization of Mistral 3 large inference on Ironwood. This blog outlines how one Google team optimized Mistral 3 large MoE model inference on Google’s Ironwood (TPU v7x), achieving a 1.5x performance gain. They did so with hybrid sharding, replacing linear VPU summations with tree reductions, optimizing GMM/MLA kernels, and adopting asynchronous scheduling. As a result, they boosted throughput by up to 48% while maintaining benchmark accuracy neutrality. Read the full blog here.

Research, reports and deep-dives

Report: Google was named a Leader in the inaugural GartnerⓇ Magic Quadrant™ for AI Infrastructure, positioned highest for ‘Ability to Execute’ and furthest for ‘Completeness of Vision’. Gartner called out Google’s proprietary scalable compute, integrated AI Hypercomputer architecture, and the scale of our AI compute capacity as key strengths. Download a copy here.
Report: We recently surveyed more than 1,400 senior IT leaders for our State of AI Infrastructure report, and a resounding pattern emerged: The gap between AI ambition and infrastructure reality is widening. In fact, 83% of organizations say they require infrastructure upgrades to support production-grade agentic AI. Read the accompanying blog to understand how adapting your infrastructure to meet the demands that agentic applications place on your systems will help you move from pilot to production.

June 2026

Product, technology and tool updates

Product update: Protecting sensitive data used with AI is a critical part of advanced and secure cloud infrastructure. Confidential Computing cryptographically protects data in use in hardware-based Trusted Execution Environments (TEEs) with verifiable data integrity, and is now available on the accelerator-optimized G4 machine series, featuring NVIDIA RTX PRO 6000 Blackwell Server Edition GPUs. Get started with Confidential G4 VMs and Confidential G4 GKE Nodes.
Developer resource: The new TPU Developer Hub is the place to go for model builders, optimizers, and developers to learn to unlock the full performance of Google Cloud TPUs. Read more in this blog.
New product: Scale your AI workloads with the new OpenTelemetry-Based TPU AI Telemetry Collector Agent. For the first time, you can route high-fidelity TPU hardware telemetry to Google Cloud Monitoring, Google Managed Prometheus, or your own self-hosted Grafana stack.

Practitioner guides and how-tos

How-to guide: Learn how to build high availability into an AI inference workload running on GKE Inference Gateway with TPUs, Cloud Storage FUSE and Dynamic Resource Allocation (DRA). This blog provides an overview, or you can get all the technical details in the hands-on codelab.
How-to guide: Did you know you can connect your AI agents to unstructured data in Cloud Storage via Model Context Protocol (MCP)? In this blog, learn about why would want to do that from three customer examples, then how to do it, choosing either a fully managed service, or a self-managed local server for more customization and control.

Research, reports and deep-dives

Report: According to an independent benchmark report, GKE Inference Gateway outperforms the next leading managed Kubernetes service with 15.7% higher throughput, 92.8% shorter wait times, and 62.6% lower inter-token latency. This performance can be attributed to its use of prefix caching, which optimizes LLM performance by storing the KV cache (activation states) of long, repetitive prompt prefixes. Learn more in the blog.
Architecture deep dive: A closer look at the cold start problem, this time for TPUs and GKE, and how the Run:ai Model Streamer can help change the dynamic.

Customer and partner updates

Customer win: Leveraging GKE, BigQuery, Cloud SQL, and Gemini Enterprise Agent Platform, Pager Health is eliminating operational fragmentation to deliver a simplified, personalized U.S. healthcare experience that transforms lives.
Customer win: Trustpilot, the customer review platform, built a high-volume streaming pipeline using fine-tuned Gemma models with Dataflow and Gemini Enterprise Agent Platform running on cost-optimized A2 VMs using A100 GPUs, as well as optimized version of vLLM maintained by Gemini Enterprise Agent Platform.

May 2026

Product, technology and tool updates

Product update: GKE Agent Sandbox is now generally available.
New open-source project: Agent Substrate is a new open-source project aimed at continuing to push the limits of agentic infrastructure density
New feature: Google AI Edge Portal, a solution for testing and benchmarking on-device machine learning (ML) at scale, now supports benchmarking and debugging on-device LLMs. Read more here.
Product deep dive: We went into depth about Cloud Storage Rapid, a new family of high-performance storage offerings for AI workloads. At launch, offerings include Rapid Bucket (formerly Rapid Storage), a high-performance zonal object storage offering, and Rapid Cache (formerly Anywhere Cache), which accelerates reads on-demand and colocates compute and data for workloads in existing buckets.

Research, reports and deep dives

Architecture deep dive: Google Global Infrastructure VP Bikash Koley and Engineering Fellow Arjun Singh provide a high-level overview of the challenges that AI workloads pose to network infrastructure, and discuss the deep enhancements we’ve made to our data center fabrics, WAN, and global networks to better support them.
Architecture deep dive: We unveiled a new cluster-level reliability model for developing frontier AI models on TPUs, ditching instance-level reliability

Customer and partner updates

Customer win: Visual media provider Imgix serves more than 8 billion images and videos from AI Hypercomputer equipped with G4 VMs powered by NVIDIA RTX PRO 6000 Blackwell GPUs.

Reimagining work: How Pythian’s internal AI playbook delivers customer ROI

Thu, 27 Aug 2026 16:00:00 +0000

When Pythian rolled out Google Cloud’s Gemini Enterprise across our 500-person company in 27 countries, the goal was simple: use our own company as a proving ground to discover how enterprise AI actually delivers ROI.

What we found changed our strategy entirely.

Since the rollout of Gemini Enterprise and our previous enterprise AI deployments, Pythian observed firsthand why so many enterprise AI initiatives stall out or fail.

Most organizations trap themselves in a tool-centric mindset — buying licenses, making tools broadly available, and assuming value will naturally follow. They get stuck chasing "nickel and dime" micro-efficiencies (like saving 5 minutes per user) while missing structural, high-ROI workflow transformations. Compounding the problem, even when custom agents are built, they frequently stall in pilot mode or break down in production because teams lack the operational capability to manage AI model drift, agent lifecycles, and ongoing observability.

To solve this, we engineered the Pythian AI Operating Model — a multifaceted, end-to-end framework designed to take enterprise AI from high-level strategy all the way into sustained production. While our dual center of excellence (COE) serves as the core execution muscle, it is the application of the entire framework, from Field CTO strategy and tooling deployment to the dual COE and XOps, that consistently unlocks million-dollar outcomes.

By proving this complete model internally first, Pythian drove a 3x surge in active user engagement and cut our database incident resolution times by 80%.

The four pillars of the Pythian AI operating model

To move past the common failure points of enterprise AI, our framework consolidates strategy, execution, and operations into a single continuous loop:

Field CTO strategy ──> tooling deployment ──> dual COE execution ──> production XOps

Field CTO strategy and governance: Generative AI is arguably the most academically challenging architectural shift in IT history. Led by former C-suite tech leaders, our Field CTO practice provides executive advisory to establish steering committees and clear value metrics. The team audits operations using 16 horizontal agentic patterns (like automated document processing and runbook creation) to build a prioritized backlog of high-ROI use cases before development starts.
Tooling and platform deployment: The team establishes a secure, production-grade foundation on platforms like Gemini Enterprise and connects AI directly into CRMs, ERPs, and database estates to ground models in real corporate context.
The dualCOE: This execution muscle is split into two specialized engines:

People productivity COE: This group handles adoption and change management. Instead of expecting non-technical teams (like HR or Procurement) to build its own agents, this COE builds no-code agents for them, focusing entirely on enablement.
Process productivity COE: This team engineers deep, custom-coded AI agents and complex agentic workflows that integrate into core data platforms for autonomous operations.

XOps (AI production management): While deploying an agent is 20% of the journey, maintaining accuracy in production is 80%. Because AI models and prompt structures naturally drift over time, this XOps practice provides the continuous monitoring, prompt tuning, and model observability needed to keep agents performing without breaking core workflows.

The difference between chasing minor, scattered efficiencies and driving structural enterprise ROI comes down to how you align your operating strategy:

Alignment element	Tool-centric approach	Pythian AI operating model
Primary metric	Individual minutes saved per user	High-impact workflow reimagination and ROI
Operational focus	Broad, unguided tool availability	Prioritized backlog via 16 agentic patterns
Execution muscle	Ad-hoc user experimentation	Dual COE (people and process productivity)
Production lifecycle	Unmonitored static deployments	Active XOps (Continuous accuracy and drift management)

Real-world impact: from database ops to global supply chains

Whether managing 70 manufacturing plants or 30,000 enterprise databases, AI succeeds when tied to structural, high-value workflows:

Pythian “as a customer:” Across 15,000 monthly database tickets, our Process COE deployed an agentic workflow that reads tickets, searches knowledge bases, and auto-generates mini runbooks before an engineer touches them. The result was slashed mean time to resolution by 80% and tripled active user engagement.
Knowledge management customer: We deployed autonomous IT support agents across 10,000 consultants. As a result, we were able to automate 10% of 20,000 annual IT tickets into "no-touch" resolutions, saving 1,000,000+ operational hours.
Supply chain customer: By building custom agentic supply chain tools on Gemini Enterprise, we compressed forecast-matching cycles from weeks down to 2–3 days across 70 global manufacturing sites.
Retail customer: We combined Gemini Agentic AI and computer vision to automate store product onboarding. As a result, we transformed a 20-minute manual task into a multi-second flow.

Ready to build your AI operating model?

Scaling AI demands more than tool-level experimentation. It also requires an end-to-end AI operating model. Learn how Pythian pairs with Google Cloud to operationalize strategy, streamline XOps, and fast-track your Gemini Enterprise journey.

FinOps for the AI era: New flexible billing and cost controls for agents

Wed, 26 Aug 2026 13:30:00 +0000

Editor's note: A product image was updated after initial publication.

As AI takes on more complex work, business leaders face a new challenge: enabling rapid innovation using agents while protecting their margins and budgets. To get a real return on AI, financial operations (FinOps) and cost management must evolve alongside technology, giving you clear visibility, proactive cost controls, and flexible payment models that fit your needs.

That’s why today we’re introducing expanded billing flexibility and new cost management tools for agent workloads across Gemini Enterprise and developer tools like Google Antigravity in Gemini Enterprise and Android Studio.

Flexible payment options: You can mix our existing, predictable per-user seat subscriptions with a new pay-as-you-go option in Gemini Enterprise app that lets you run agent workloads without hitting quota limits mid-task.
Developer access, one place to manage your AI: Google Antigravity and Android Studio AI use is now included in your Gemini Enterprise subscription (available for select customers and rolling out broadly soon), giving your developers more without giving you more to manage. Usage across Antigravity, the platform, and the app rolls up into a single view instead of separate licenses and billing silos.
Pay less as your usage grows: If your AI workloads are steady or climbing, Flexible Savings Plans let you commit to a monthly spend you're comfortable with and take 10–20% off your token costs — no minimums, no maximums, and no new billing silo to manage.
Consolidated spend guardrails: You can now set hard monthly caps on AI spend and projects, estimate agent runtime costs, and catch sudden budget spikes before they hit your invoice.

Give your teams flexibility without losing control over spend in Gemini Enterprise

Every organization operates differently. Even within the same business, no two teams consume AI in the same way. Your business users might rely on steady, everyday productivity tools. Meanwhile, your technical teams might run AI agent workloads in bursts.

To help align costs with how work actually gets done, you can combine these payment and licensing choices and features across Gemini Enterprise:

Option	How it works	Why it helps optimize spend
Gemini Enterprise app per-user seat subscription	You pay a fixed monthly fee per user, which includes daily quota pools that are shared across your entire project.	Predictable budgeting. It provides finance teams with a clear, steady monthly baseline for teams with consistent daily productivity needs.
[New] Gemini Enterprise app pay-as-you-go consumption edition *available for select customers and rolling out broadly soon	There is no upfront commitment or base subscription fee, meaning you pay strictly for the compute and tokens your teams consume at standard model API rates.	Only pay for what you use. Your spend scales up and down automatically with real usage, ensuring you never pay for empty seats when project demand dips.
[New for Antigravity in Gemini Enterprise] Consolidated pooled quotas	Daily usage allowances are pooled project-wide, letting business apps, developer tools, and custom agents draw from the same shared quota. Pooled quota is always exhausted first, and admins can control if overages are allowed, at which point it’s charged at pay-as-you-go rates.	Maximized resource usage: Unused daily allowances from business users automatically absorb heavy developer or custom API agent demands, so no quota allowance goes to waste.
[Coming soon] Deferred execution pricing *available for select workloads soon	Mark eligible agent workloads as deferred, and our intelligent scheduler in the Gemini Enterprise Agent Platform runs them during off-peak capacity windows.	Substantial discounts for work that can wait: AI workloads can run on separate, off-peak capacity, you pay up to half the inference cost and bypass standard quota limits entirely – letting you run substantially more agentic volume under the same budget.

Equip developers with advanced agentic tooling under a single Gemini Enterprise subscription

We’re rolling out access to Google Antigravity in Gemini Enterprise, an agent-first developer platform that brings powerful agentic coding and agent-building capabilities to technical teams, included with Gemini Enterprise subscriptions for eligible customers. In addition, Android developers can leverage the Google Antigravity quota included in their Gemini Enterprise subscriptions natively in Android Studio, the agentic IDE for professional Android development.

To be more efficient with agentic coding costs, we are pooling developer tools quota included in each Gemini Enterprise subscription and making it available across the whole Google Cloud project so your teams can benefit from the capacity you’re already purchasing. Your developers get access to advanced agentic tools, while you maintain centralized governance and control.

For a closer look into what’s new with Antigravity in Gemini Enterprise and how customers are putting it to work in production, take a look at our deep-dive.

Budget smarter with Gemini Enterprise Flexible Savings Plans (FSPs)

If your organization has steady or growing AI workloads, Gemini Enterprise Flexible Savings Plans offer a simple, spend-based commitment model across Gemini Enterprise usage. FSPs are designed to lower token costs while keeping budgets flexible:

Programmatic savings: Receive 10% off for 1-year or 20% off for 3-year commitments for monthly spending across Gemini Enterprise.
Tailored to your pace: With no minimum or maximum spend requirements, you can determine a monthly commitment that fits your current traffic and make adjustments as your usage increases over time.
Enterprise Agreement (EA) friendly: FSP spend seamlessly draws down against your existing Google Cloud EA, giving lines of business dedicated budget control without fragmenting your broader cloud commitments.

Gemini Enterprise Flexible Savings Plans are already available for self-serve customers and customers on enterprise agreements.

Give your teams the freedom to build while maintaining financial discipline

As a leader, your goal isn't to restrict the potential value of AI – it's to remove the financial and operational risk that you face without managed AI costs. You should be able to give engineering, marketing, and operational teams the freedom to innovate with agents, but you should also have the visibility to trust what those agents are doing and the safety nets to protect your budget.

To bridge this gap, we've built robust, native governance tooling directly into the Google Cloud Billing Console around three simple goals:

1. Plan before you scale: The Google Cloud Pricing Calculator lets you estimate anticipated costs in Gemini Enterprise across per-user licenses, developer tools, and background agent runtimes. It gives you the numbers you need to build clear business cases upfront before project work begins.

2. Enforce boundaries without micromanaging spend: Instead of spending time tracking daily usage variations across project teams, let these tools do the monitoring for you:

Early anomaly detection: If a project’s AI spending trends higher than normal, the system flags the deviation with root cause analysis and pinpoints the top 3 SKUs driving the increase so you can see exactly what changed.

Billing Console showing an Early Anomaly alert with the Root Cause Analysis (RCA) breakdown highlighting the driving SKUs

- Project-level spend caps: When a project needs defined financial boundaries, you can set a firm monthly spend limit directly in the Google Cloud Billing Console. If a project hits its limit, the agent's API calls temporarily pause – protecting your budget without affecting the rest of your production infrastructure. Automated email alerts at 50%, 80% and 100% of the budget keep you informed of your progress against the spend limit.

- Overage controls: If a spend cap triggers, you can choose to resume work with a single click in the console. Alternatively, if your priority is continuous operation, you can turn on overages so excess usage smoothly transitions to consumption rates, which can draw directly against your FSP to keep overage unit costs heavily discounted.

Enabling overage pay-as-you-go for a project.

3. Get visibility into business value: Use centralized billing reports paired with the FinOps agent to generate natural-language cost insight summaries of where your budget went, making it simple to show ROI to leadership.

AI spending reporting in Google Cloud Console

Go deeper with AI cost optimization

To build a full-stack FinOps strategy that optimizes the cost, latency, and performance of your models and infrastructure, explore our detailed architecture specifications and frameworks:

How to outsmart infrastructure constraints with dynamic capacity management: Discover how to optimize your compute investments with capabilities in Google Kubernetes Engine and Google Compute Engine that automatically schedule and reallocate resources to avoid interruptions, over-provisioning, and over-reliance on any one hardware configuration.
Expanding Google Antigravity for Enterprise Customers: Read our developer tooling deep-dive to see how technical teams are accelerating software delivery with agent-first workflows.
What sports cars can teach us about optimizing AI spend: More tokens doesn't always mean better AI. Read our conversation with Mike Clark, Director of Product Management for Gemini Enterprise Agent Platform, on how to balance horsepower with efficiency and get the highest return out of every dollar you spend on AI.
Protection during usage spikes: Your heavy workloads can surge during peak hours without forcing you to pay for expensive, dedicated infrastructure that sits idle the rest of the time. As your AI usage grows, Gemini models can automatically scale on demand without hitting artificial rate limits – processing up to 50 million tokens per minute. Read more about Provisioned Throughput.

Now introducing Gemini Enterprise for Legal

Tue, 25 Aug 2026 12:00:00 +0000

Few professions are as exacting as the practice of law. A team reviewing a contract or building a case works inside strictly privileged information, firm-specific playbooks, and a body of law that changes constantly. The work thrives on nuanced, professional judgment — and the systems supporting it inherit real obligations: ethical walls that cannot be crossed, matter permissions that cannot be flattened, and a duty of confidentiality that does not bend for convenience.

General-purpose AI, however capable, does not meet that standard on its own. Foundational model intelligence is necessary. For legal work, it is nowhere near sufficient.

What makes the difference is the system built around the model: skills that enhance a firm's own expertise, connections into the systems where matters actually live, agents that complete work rather than return suggestions, and an open ecosystem to extend all of it — with governance running underneath all four. Each is valuable alone. Only in combination do they produce something a firm or a legal department can put into production and actually rely on.

Today we're bringing that to legal practice with Gemini Enterprise for Legal, part of our new suite of purpose-built industry solutions.

Bringing Gemini Enterprise to your legal practice

Four components of Gemini Enterprise for Legal

Developed alongside industry leaders, Gemini Enterprise for Legal provides an integrated, fully governed environment configured for rapid deployment across firms and corporate legal departments:

1. Purpose-built skills for legal work. Skills are reusable packages of instructions and context, designed by domain experts, that teach an agent to run a specialized task while enforcing your firm's playbooks, citation rules, and house style. They cover contract review and redlining, playbook creation, regulatory horizon scanning, legal research, DSAR fulfillment, and more — and they are where a firm's institutional knowledge becomes something the platform can execute rather than something a partner has to re-explain.

2. Connections to trusted systems and data. Secure MCP connectors link agents to the document management systems, case repositories, research services, and industry applications legal teams already rely on — inheriting each platform's existing user permissions and access controls rather than working around them.

3. Agents that act within the data. Skills and connections come together in agents that carry work through: pre-built agents from Google and leading legal software providers deploy out of the box. Specialized agents handle legal and policy research, regulatory screening, and contract drafting — bringing deep legal expertise onto a platform with centralized governance.

4. An open partner ecosystem. Every firm and legal department practices differently. Partnerships with global systems integrators and legal-tech specialists — Accenture, Deloitte, Devoteam, Factor Law, KPMG, Tribe.ai, Valtech, Zazmic, Zencore, and 66degrees — let organizations customize, integrate, and scale across complex enterprise architectures without vendor lock-in.

Running underneath: a governed control plane. A single dashboard for legal IT and risk teams that natively enforces security policies (VPC, CMEK), maintains private data isolation, and holds every output to verifiable grounding with traceable citations.

Unlocking high-value workflows with domain-specific skills

Gemini Enterprise for Legal shifts AI from passive querying to agentic execution, automating high-volume, precision-critical workflows such as:

Proactive regulatory horizon scanning: Keeps legal and compliance teams ahead of global mandates by autonomously tracking legislative updates, court dockets, and supervisory bodies. It cross-references emerging changes against enterprise policies to flag exposure gaps and generate updated policy drafts for immediate practitioner review.
Automating data discovery and DSAR response: Modernizes privacy workflows by compiling personal data across fragmented enterprise systems in seconds. It eliminates the manual toil of Data Subject Access Requests (DSARs), and allows for adherence to regulatory timelines while minimizing operational risk.
Accelerating contract review and negotiation: Compresses turnaround times for inbound vendor agreements, NDAs, and complex M&A documentation by benchmarking terms against enterprise playbooks. It surfaces high-risk clauses and potential exposure, enabling attorneys to focus on strategic negotiation and high-value judgment.
Building and updating contracting playbooks: Transforms legacy agreement archives into dynamic, actionable playbooks instantly. It automatically extracts key terms, fallback positions, and institutional knowledge to maintain portfolio-wide term consistency and lower negotiation variance across the enterprise.
Redacting documents for motions to seal: Eliminates the manual burden of preparing court filings and redacting legal documents. It intelligently identifies sensitive terms and PII for rapid practitioner confirmation, dramatically accelerating filing timelines while safeguarding confidentiality.
Drafting NDA documents: Elevates contract creation through structural fidelity validation that enforces firm standards and logical document hierarchies. It allows legal teams to rapidly generate and evolve non-disclosure agreements with complete formatting confidence and minimal review overhead.

Open ecosystem of connectors across the legal technology stack

Legal work is only as good as its sources, and legal data carries permissions that have to travel with it. Gemini Enterprise for Legal connects directly to core legal systems via secure MCP connectors. Crucially, access is bound by existing role-based access controls, document-level permissions, and trusted data controls inherited from document management and ediscovery systems.

Productivity and collaboration:

Google Workspace: Connects seamlessly with Google Docs, Gmail, Drive, and Sheets to analyze matter communications, correspondence, and surface internal files while enforcing enterprise access controls.
Microsoft 365: Integrates directly with Word, Outlook, and SharePoint to triage inquiries, redlines, and securely ground work product across emails and matter folders without breaking workflow context.

Document management:

iManage: Gives Gemini Enterprise for Legal permission-bound, auditable access to governed iManage content, including matter history, documents, and institutional knowledge, eliminating the need for bulk exports or custom integrations.
NetDocuments: Enables Gemini Enterprise to search and analyze an organization's knowledge and expertise while preserving each user's existing permissions and ethical walls. Source documents never leave the governed NetDocuments environment.

Contract lifecycle and execution:

Docusign: Integrates agreement metadata, active approval workflows, and contract repositories to surface obligations, track renewal dates, and streamline drafting-to-execution lifecycles.

E-discovery and litigation intelligence:

Everlaw: Connects Gemini Enterprise to litigation and investigations evidence in Everlaw, allowing legal teams to search and analyze their data, uncover case insights, and build timelines directly in Gemini Enterprise, with responses grounded in the underlying documents and access governed by each user’s existing Everlaw permissions.
RelativityOne: Allows legal teams to stand up workspaces, organize case data, and manage operations within a secure perimeter.

Primary law, research, and public dockets:

Thomson Reuters HighQ: Connects Gemini Enterprise for Legal with HighQ, helping legal teams securely access and reference relevant HighQ content within their workflows.
Free Law Project’s CourtListener.com: Provides access to millions of federal and state court opinions, PACER dockets, judicial profiles, and oral arguments.
Courtroom5: Delivers jurisdiction-aware civil litigation datasets, procedural rules, and deadline calculation logic.

Specialized legal AI and intellectual property:

Harvey: Bridges Harvey’s legal reasoning intelligence into Gemini Enterprise, supporting complex legal reasoning and research across Vault projects.
Solve Intelligence: Links Gemini Enterprise to worldwide patent and non-patent literature, SEP technical standards, and prior art databases for patent drafting and claim charting.
Legora: Agentic operating system for legal work, supporting lawyers in research, review, and drafting across complex matters

Third-party agents and implementation partners

Every firm and legal department practices differently. Through our open platform, organizations can deploy pre-built partner agents or collaborate with systems integrators to scale custom capabilities:

Deloitte: Contract Summarize Pro Agent that synthesizes complex contracts into clear summaries for rapid insight and informed decision-making. Clause Guard contract redlining agent to accelerate turnaround times, and minimize risk in contract management.
Eudia Knowledge agent: Accelerates high-stakes legal and contracting work by combining institutional intelligence with a suite of agents that execute deep legal research, high-volume document analysis, and regulatory compliance screening.
Global systems integrators & tech partners: Strategic partnerships with Accenture, Deloitte, Devoteam, Factor Law, KPMG, Tribe.ai, Valtech, Zazmic, Zencore, and 66degrees ensure legal teams can customize, integrate, and scale these capabilities across complex enterprise architectures without vendor lock-in.

Gemini Enterprise for Legal offers leading firms a way to manage modern legal work with a secure agentic platform

Developed alongside leading global law firms

We are working closely with leading law firms, including Cleary Gottlieb, Freshfields, Weil, and Williams & Connolly, to ensure these capabilities address the realities of sophisticated legal practice.

“Cleary is committed to embedding AI into our workflows in strategic and competitive ways. Using Google’s Gemini Enterprise, which can slot in seamlessly with other daily work tools, we can unlock greater efficiencies for our teams and help them deliver even higher quality work for our clients.” — Jeff Karpf, Managing Partner, Cleary Gottlieb.

“The legal sector is entering a period of accelerated change and transformation. For Freshfields the opportunity lies in how effectively we combine frontier technology like Gemini Enterprise for Legal with our expertise, robust governance and institutional knowledge to create value for our clients. Our strategic, multi-year partnership with Google Cloud is helping us accelerate that work and enhance how we deliver legal services.” — Alan Mason, Global Managing Partner, Freshfields.

“We’re thrilled to partner with Google Cloud in the early adoption of Gemini Enterprise for Legal. We look forward to integrating Google’s technology to streamline workflow and further support our litigators in shaping outcomes critical to our clients’ futures.” — Joe Petrosinelli, Chairman, Williams & Connolly.

"Our collaboration with Google gives us early access to emerging capabilities while allowing us to help shape the platform based on the realities of sophisticated legal practice. The result is technology that helps us continue to deliver the innovative, high-quality service our clients expect from Weil. We are looking forward to working with Google Cloud engineers and the Gemini Enterprise product team as we further innovate and evolve our AI capabilities." — Ramona Nee, Incoming Executive Partner, Weil.

Weil scales judicial insights with Benchmark, built on Gemini Enterprise

Built on an enterprise-grade foundation

Confidentiality is not a feature of legal technology; it is the precondition for using any at all. Because Gemini Enterprise for Legal runs on Google Cloud infrastructure and the Gemini Enterprise platform, the permissions and access controls your firm already maintains are the boundaries the platform operates within — not settings it asks you to reconstruct.

Client data, firm-specific playbooks, intellectual property, custom agents, and model outputs stay private to your organization, and are never used to train or fine-tune Google's foundation models. Because we operate the full stack, from infrastructure and models through the application layer, we can tune performance and cost together — so expanding what your teams can take on does not mean expanding spend at the same rate.

This is just the beginning

The launch of Gemini Enterprise for Legal represents another defining step in delivering on the promise of Gemini Enterprise: bringing the best of Google AI to every professional, for every workflow, natively tailored to the way they work.

Gemini Enterprise for Legal is available in preview today, launching alongside our new purpose-built solution for Financial Services. We invite law firms and legal teams to explore how Gemini Enterprise can transform their most critical workflows, with solutions for Healthcare, Life Sciences, and other Professional Services on the horizon.

Now introducing Gemini Enterprise for Financial Services

Tue, 25 Aug 2026 12:00:00 +0000

Protecting capital in today's markets requires immense speed and precision. A financial analyst preparing a deal memo works across licensed market data, internal models, and confidential client files. General-purpose AI lacks the real-time accuracy, verifiable data lineage, and strict security that financial institutions demand. While model intelligence is necessary, without deep integration into trusted financial systems, it is not sufficient.

Making AI genuinely useful inside an industry requires four things, together: domain expertise encoded into reusable skills, secure connections to the systems and data the work depends on, agents that can act inside real workflows, and an open ecosystem that extends and scales all of it — with governance running underneath all four. Each is valuable alone. Only together do they produce something an institution can actually put into production and see true return on investment.

Today, we are delivering on this vision with Gemini Enterprise for Financial Services, bringing Google’s agentic AI directly into the workflows of capital markets and corporate banking.

Bringing Gemini Enterprise into the workflows of capital markets and corporate banking

Four components, built for financial work

Gemini Enterprise for Financial Services delivers an integrated, secure environment configured for rapid deployment with four core components:

1. Purpose-built financial skills. Skills are reusable packages of instructions and context that teach an agent to run a specialized task the way your institution runs it — applying custom formatting to a report, pulling a specific data cut, following a defined research methodology. They are available inside the Financial Research agent and to any agent your teams build.

2. Secure Model Context Protocol (MCP) connectors. Direct integrations, using MCP, into essential financial platforms and licensed data sources, configured inside your own environment. Access stays bound by the entitlements you already maintain — licensed data stays licensed, and permissioned data stays permissioned.

3. Agents that act. At its core is the Financial Research agent which is a Google-built, Google-managed agent that runs end-to-end research with full explainability. It ships with more than 50 foundational skills and exposes its reasoning through confidence scores, explicit methodologies, data snapshots for auditing, and precise source citations. Analysts can use it directly in the Gemini Enterprise app or wire it into existing agent workflows through Agent-to-Agent (A2A) APIs, and it connects to enterprise data sources over MCP to produce reports and documents in the formats your teams already use. Alongside it, out-of-the-box partner agents cover other workflows and extend the capabilities further.

4. An open partner ecosystem. Scale with global systems integrators and specialized fintech providers including 66degrees, Accenture, Artefact, Capgemini, Cognizant, Deloitte, Genpact, GFT Technologies, Infosys, KPMG, PwC, Quantiphi, Slalom, Tribe AI, and Zencore to customize and integrate the platform into your own architecture, without vendor lock-in.

Running underneath: a governed control plane. A single dashboard for IT and risk teams that natively enforces security policies (VPC, CMEK), maintains private data isolation, and holds every output to verifiable grounding with traceable citations.

Unlocking high-value workflows with domain-specific skills

Whether used by private equity specialists, wealth managers, or compliance teams, the solution adapts to diverse workflows like credit risk assessment, portfolio monitoring, market news synthesis, and investigative financial research:

Elevate advisor insights: Equips relationship managers and advisors with AI-generated insights, personalized recommendations, and tailored artifacts, enabling higher-quality conversations and fostering loyalty.
Deepen Know Your Customer (KYC) research and analysis: Modernizes onboarding and Know Your Customer (KYC) workflows across private banking and prime brokerage by using multi-format ingestion (PDFs, Excel, SEC filings) to map complex corporate hierarchies, evaluate risk personas, and resolve ultimate beneficial owners (UBOs).
Enhance portfolio resilience: Helps trading desks deal with sudden macroeconomic shocks. It reduces complex bond portfolio risk exposure analysis to a sub-5-minute execution, complete with automated duration-hedging strategy suggestions.
Uncover credit market opportunities: Transforms credit data into actionable trade ideas by identifying and isolating potential mispricings. This enables teams to expand trading volumes while lowering back-office risk and underwriting latency.
Accelerate bond issuance: Compresses client pitch presentation timelines from days to minutes so that fixed-income and underwriting teams can proactively target prospects, increase deal capacity, and secure a crucial first-mover advantage to help win more business.

Open ecosystem of connectors across the financial technology stack

Gemini Enterprise connects directly to core financial systems via secure MCP connectors. Access is bound by existing role-based controls, ensuring verifiable grounding and precise source citations:

Productivity and collaboration:

Google Workspace: Enables seamless analysis and live artifact generation across Docs, Sheets, and Slides while adhering to enterprise DLP policies.
Microsoft 365: Integrates directly with Excel, Word, and PowerPoint to populate financial models, research memos, and client pitch decks.

Market data and financial fundamentals:

Daloopa: Provides the structured, source-linked financial data layer that enables finance professionals and AI tools to produce accurate and auditable results.
FactSet: Enables secure, authorized access to FactSet's multi-asset class financial and non-financial datasets, powering reliable AI-driven workflows with fully auditable, compliant insights.
Finnhub: Provides real-time financial APIs, global fundamentals, and earnings call transcripts for in-depth financial research.
Fiscal.ai: Delivers institutional-grade financial data within minutes of earnings, covering financials, news, ownership, segments & KPIs, filings, and earnings call transcripts.
Guidepoint: Connects to primary research insights and expert network transcripts to inform and validate investment theses.
LSEG: Provides access to a broad range of trusted financial data, analytical models, indices and news. Enabling customers turnkey access to trusted financial intelligence across every stage of the investment lifecycle.
S&P Global: Integrates cited, verifiable S&P Global data for a range of workflows, from financial analysis, to peer benchmarking, industry research, and more.

Risk, ratings, and private markets:

Moody’s: Brings ratings, default risk models, and real time news fused into one lens for counterparty risk assessment.
MSCI: Connects to proprietary indexes, data and models spanning public and private assets and also provides risk analytics and factor exposures.
PitchBook: Provides comprehensive data and research on private equity, venture capital, credit, M&A, and public markets, including, company financials, deal terms, valuations, and fund performance.

Regulatory and corporate records:

SEC Edgar: Delivers instant, verifiable retrieval of statutory filings, 10-Ks, 10-Qs, and 8-Ks with precise citation mapping.
Dun & Bradstreet: Accelerates commercial onboarding and KYB verification through direct access to global corporate hierarchy records.

Digital assets and indices:

CoinDesk Data and Indices: Supplies institutional-grade digital asset pricing, benchmark indices, and crypto market intelligence for multi-asset strategies.

Introducing Gemini Enterprise for Financial Services

Third-party agents and implementation partners

Organizations can deploy out-of-the-box partner agents or collaborate with global systems integrators to scale custom capabilities without vendor lock-in:

D&B Business Verification agent: Accelerates commercial onboarding and strengthens KYC compliance.
FlowX agents: Automate loan pack completeness check, document reconciliation and many other mission critical processes for financial institutions.
Obin Financial agent: Helps asset management, commercial lending, and insurance teams accelerate complex financial analyses.

S&P Global agents: Data Retrieval Agent for multi-step analysis, report generation, research workflows, and the Horizons Agents that help turn complex energy and sustainability data into fast insights for finance workflows.
Global systems integrators and tech partners: Strategic partnerships connect firms with specialist FinTech and leading global systems integrators, including 66degrees, Accenture, Artefact, Capgemini, Cognizant, Deloitte, Genpact, GFT Technologies, Infosys, KPMG, PwC, Quantiphi, Slalom, Tribe AI, and Zencore to manage custom configurations and deploy specialized capabilities at a global scale.

Developed alongside leading global financial institutions

We are developing these capabilities in close collaboration with financial institutions, including Deutsche Bank and CME Group, to ensure they reflect the operational realities of the industry.

“As a design partner for the Financial Research agent, Deutsche Bank has helped shape this capability in view of the realities of a highly regulated industry – from data protection and governance to the workflows our teams use every day,” said Marie-Jeanne Deverdun, Chief Technology, Data and Innovation Officer, and Member of the Deutsche Bank Management Board. “Starting in the Corporate Bank, we see significant potential to reduce manual research effort, improve the consistency and auditability of outputs, and give our teams more time for client conversations. This is an important step in applying AI where it can make a practical difference: safely, responsibly and at scale.”

This launch builds on the rapidly growing momentum of Gemini Enterprise, with many leading financial institutions like BNY, Citi Wealth, Lloyds Banking Group, Macquarie Bank, and Signal Iduna using it to equip their workforce with advanced, agentic workflow tools to drive growth and efficiency.

Built on an enterprise-grade foundation

Because Gemini Enterprise for Financial Services runs on Google Cloud infrastructure and the Gemini Enterprise platform, organizations get the security, governance, compliance, and cost-management capabilities they expect from an enterprise platform.

Customer data, business rules, intellectual property, custom agents, and model outputs remain private to their organization. Your data is never used to train or fine-tune Google’s foundation models. Furthermore, our full-stack approach - from infrastructure and models to the application layer - allows us to optimize performance and cost, helping organizations maximize the value of their AI investments.

This is just the beginning

Gemini Enterprise for Financial Services is available in preview today, launching alongside our new purpose-built solution for Legal. We invite enterprise leaders in financial institutions to explore how Gemini Enterprise can transform their most critical workflows, with solutions for Healthcare, Life Sciences, and other Professional Services on the horizon.

Cloud CISO Perspectives: Sticking to security fundamentals in the AI era

Fri, 21 Aug 2026 16:00:00 +0000

Welcome to the first Cloud CISO Perspectives for August 2026. Today, Chris Betz explains why the AI era makes it more important than ever to lean into security fundamentals.

As with all Cloud CISO Perspectives, the contents of this newsletter are posted to the Google Cloud blog. If you’re reading this on the website and you’d like to receive the email version, you can subscribe here.

aside_block: <ListValue: [StructValue([('title', 'Get vital board insights with Google Cloud'), ('body', <wagtail.rich_text.RichText object at 0x7f1876eb80a0>), ('btn_text', 'Visit the hub'), ('href', 'https://cloud.google.com/solutions/security/board-of-directors?utm_source=cgc-site&utm_medium=et&utm_campaign=FY26-Q2-GLOBAL-GCP39634-email-dl-dgcsm-CISOP-NL-177159&utm_content=-&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

How to stay strong with security fundamentals in the AI era

By Chris Betz, CISO, Google Cloud

Chris Betz, CISO, Google Cloud

As AI accelerates the capabilities of adversaries, foundational strength becomes the primary differentiator between resilience and vulnerability. It’s a dangerous and unfortunately common misconception that traditional security fundamentals are becoming obsolete. For CISOs, the challenge is to adopt new AI technology securely while scaling essential, effective defensive practices to move at the speed of the adversary.

For both attackers and defenders, AI has been a catalyst for optimization and innovation. While traditional automation has allowed us to perform repetitive tasks at scale, AI enables both sides to execute highly-specific, customized actions at massive scale and unprecedented speed.

Collectively, these technologies reduce the attack surface and contribute to the deep context that defensive AI needs to be a business enabler — and create the necessary conditions for successful AI-powered defenses.

We can see the threat developing almost in real-time. Adversaries are deploying new malware with just-in-time AI that dynamically generates malicious scripts and obfuscates code mid-execution to evade detection. They use sophisticated vishing and deepfakes for identity theft and business email compromise. We even see unauthorized AI tools lead to the rise of shadow agents.

Defending against AI powered security threats requires more than accelerating current security practices; it means stepping back and beginning with the security foundation and layered defenses. It’s critically important to build and use a layered defense with the right guardrails — foundational cybersecurity building blocks that we’ve been investing in for years.

Doubling down on this foundation: technologies like multi-factor authentication (MFA), Zero Trust frameworks, consistent system patching, and comprehensive detection and response. Collectively, these technologies reduce the attack surface and contribute to the deep context that defensive AI needs to be a business enabler — and create the necessary conditions for successful AI-powered defenses.

Revolutionizing vulnerability management

In just a few short years, identifying and fixing vulnerabilities has evolved from a mostly laborious, manual process to one driven by AI tools discovering vulnerabilities at volumes never seen before. Further, the time to exploit window has essentially been eliminated.

However, it’s not enough to merely discover vulnerabilities, especially at today’s volumes. You still need to prioritize fixing those that have the most critical impact on your systems and networks first, and that necessitates an equally-rapid response in smart mitigation.

Organizations use multiple models to scan for flaws and then suggest high-quality code fixes that engineers can quickly move into production, leveraging capabilities like AI Threat Defense. AI allows us to automate the entire software development lifecycle, from discovery to testing and deployment, ensuring that our defensive posture evolves faster than the threats targeting us.

Enhancing threat modeling

We’re also seeing the fundamental concept of threat modeling have an outsized impact. Doing threat modeling well requires bringing context together from your code, your cloud architecture, system design, and network pathways.

While it isn’t easy, using AI can scale our ability to bring that data together into a coherent picture. Teams have been experimenting with multi-AI models to collect system information and enumerate threats.

As I noted in June, engineering teams at Google Cloud now route product launches through an agent-based security review pipeline. High-risk indicators automatically get flagged for human review, while we’ve replaced static threat models with dynamic product dossiers that update in real-time.

The CISO as a strategic business leader

The most effective security leaders that I know today are more than just technologists: They are strategic business leaders. The intense global focus on AI vulnerabilities has brought cybersecurity to the forefront of boardroom and executive attention like never before.

This visibility is an opportunity to lead. We CISOs are expected to communicate with clarity, from the board to the C-suite to the security teams who look to them on a daily basis, demonstrating their ability as capable strategists who can navigate the complexities of AI while safeguarding the organization's growth.

By aligning security fundamentals with business objectives and using AI to enhance defense, we can lead our organizations securely into the future.

To learn more about building and maintaining strong security foundations in the AI era, read our newest Defender’s Advantage: Cyber Snapshot Report.

aside_block: <ListValue: [StructValue([('title', 'Learn something new'), ('body', <wagtail.rich_text.RichText object at 0x7f1876eb8d00>), ('btn_text', 'Watch now'), ('href', 'https://www.youtube.com/watch?v=CmGWIwgHR60'), ('image', <GAEImage: Cloud-CISO-Perspectives-logo-A>)])]>

In case you missed it

Here are the latest updates, products, services, and resources from our security teams so far this month:

Driving AI threat readiness with Wiz: Announcing new Wiz capabilities that can help organizations prepare for the AI era by expanding visibility and accelerating response, so your security teams can defend at machine speed. Read more.
PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap: We’ve long been actively working on and rolling out post-quantum cryptography in our infrastructure. Here’s our updated Google Cloud roadmap to migrate to PQC by 2029. Read more.
How Google Cloud detects, contains, and protects against emerging threats: Learn more about how Google Cloud empowers you with the tools, governance, and infrastructure you need to securely deploy workloads and maintain long-term trust. Read more.
Privacy-first medical AI with MedPerf and Google Cloud: Discover how Google Cloud and MedPerf use Confidential Computing to enable secure, privacy-first collaborative medical AI evaluation. Read more.
More cryptanalysis makes us all safer: Recent advances in frontier AI models do not signal the downfall of cryptography. Here’s why they’re best viewed as additional cryptanalysts. Read more.
How layered defenses harden Chrome against abusive notifications: Learn how Chrome Security has collaborated with Firebase Cloud Messaging (FCM) and Safe Browsing to significantly reduce notification abuse, and improve the security and quality of the web ecosystem for everyone. Read more.

Please visit the Google Cloud blog for more security stories published this month.

aside_block: <ListValue: [StructValue([('title', 'Join the Google Cloud CISO Community'), ('body', <wagtail.rich_text.RichText object at 0x7f1876eb8160>), ('btn_text', 'Learn more'), ('href', 'https://rsvp.withgoogle.com/events/google-cloud-ciso-community-interest-form-2026?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY25-Q1-global-GCP30328-physicalevent-er-dgcsm-parent-CISO-community-2025&utm_content=cisop_&utm_term=-'), ('image', <GAEImage: GCAT-replacement-logo-A>)])]>

Threat Intelligence news

Staying ahead of adversarial AI through agentic source code review: To help defenders implement agentic approaches similar to our approach at Google Cloud, we are sharing the details of our Agentic Vulnerability Discovery Harness architecture for the first time. AVDH can also be used alongside CodeMender’s ongoing scanning to create a two-layered defense strategy. Read more.
Cloud threat highlights from the first half of 2026: In the first half of 2026, Wiz's Research and CIRT teams tracked threats affecting thousands of cloud environments. We saw a notable increase in the volume of activity, with supply-chain attacks running at a previously unseen scale and developer toolchains and AI infrastructure drawing serious attention. Read more.
Batten down your packages: Mitigation guidance for supply chain compromise: GTIG and Mandiant have tracked ongoing and increasing open source software supply chain compromise campaigns over the past several years. Here are our mitigation and hardening recommendations to secure software supply chains, including insights we have developed as a result of supporting customers. Read more.
Multi-brand vishing extortion targets financial services and enterprise cloud environments: Telemetry and infrastructure analysis reveal that UNC6671 has not disbanded. Instead, the threat group has diversified its operations across multiple extortion fronts including Redact, Pink, Helix, and Falcon and continues to rely on voice phishing to target enterprise employees. Read more.
Keyv and cacheable npm package hijacked in supply chain attack: Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages. Read more.
Inside the Metabase SQLi: Exploited in the wild: Wiz has reverse engineered Metabase CVE-2026-72898 with AI to accelerate defense. Here’s what we learned. Read more.

Please visit the Google Cloud blog for more threat intelligence stories published this month.

Now hear this: Podcasts from Google Cloud

Cloud Security Podcast: All about Project Atlas, Wiz's AI vulnerability research: Near Orfeld, head of vulnerability research, Wiz, discusses how his team uses multi-agent AI systems for discovering high-impact zero-day vulnerabilities in cloud infrastructure. Listen here.
Cloud Security Podcast: How Google eliminates classes of vulnerabilities at scale: How do you build the foundations for a secure Google-scale enterprise that stays secure even if an AI is writing the code and nobody has time to review it? Christoph Kern, principal security engineer, Google, explores what secure-by-design really means in the AI era. Listen here.

To have our Cloud CISO Perspectives post delivered twice a month to your inbox, sign up for our newsletter. We’ll be back in a few weeks with more security-related updates from Google Cloud.

How agents can delegate better

Fri, 21 Aug 2026 16:00:00 +0000

In any organizational behavior class, students will learn that effective delegation is among the most important skills for a seasoned leader. Getting meaningful work done involves careful coordination, starting with a subdivision of projects into manageable tasks, mapped onto the skills of the team, and assigned to the right people.

At Google Cloud, we’re learning a similar lesson when it comes to building and deploying AI agents in enterprise workflows. These workflows are best approached by multi-agent systems that can break apart and execute complex tasks. To do so, AI agents need to become good delegators.

To learn how, we turned to research from Google DeepMind. In their recent study titled Intelligent AI Delegation, they prove how delegation itself involves intelligence: adaptive negotiations, aligning on formal contracts, and security guardrails.

This work opens up new opportunities for customers building AI agents that can communicate, share tasks, and coordinate towards set objectives. Today, we’ll share four principles that emerged from that work, and how you might apply them to your own workflows.

Principle 1: Verify delegated work

If we are to permit AI to delegate tasks, we want it to do more than arbitrarily assign work. Agents should intelligently break down work into tasks that can be reliably verified. In our research, we call this "contract-first decomposition."

Like human delegation, this takes thoughtful deliberation. With people, this might mean a leader understanding their team’s strengths, and perhaps checking their work before it’s completed. For AI, there’s a similar learning curve. The orchestrating AI (the manager that sits atop a multi-agentic system) may consider multiple plans for how best to decompose and assign work, and keep decomposing sub-goals into smaller and smaller chunks until they become sufficiently simple to monitor and verify. Ideally, this should result in a plan where everything can be reliably graded. In reality, however, this may not always be possible to achieve.

Sometimes, it may be necessary to involve subjective assessment of whether work has been completed successfully, in line with expectations. Rather than being a problem, identifying such components helps us determine where human time is best spent, and how best to involve human expert judgement in oversight of agentic systems.

Principle 2: Be smart about cost

The research framework helps us answer a question that keeps coming up with customers: Can this particular task be handled by a smaller, cheaper model? Enterprises are increasingly attentive to cost, and rightly so.

Finding the right balance between performance and budget is tricky. Taking a complex problem, like payroll, and handing it off to a lightweight model, might not be powerful enough for the results you want. On the other hand, it’s unnecessary to route simple tasks, like reformatting a spreadsheet, to a strong reasoning model.

According to the research, an agent that is intelligent about delegation would learn to recognize these scenarios, and match each task to the right tool or endpoint, to achieve the desired result and maximum reliability at a minimum cost. Use of model routing capabilities within API gateways is becoming a popular choice among customers, in addition to the alternative for using client-side proxies (such as LiteLLM).

You can learn more about model routing here.

Principle #3: Respect sensitive data

Many workflows handle private, sensitive data, and AI agents need to respect those boundaries and permissions. For example, if you’re deploying your orchestrator agent for payroll data, you know that agent should never pass along its full set of information to a sub-agent. This not only compromises security, but also bloats the context window for agents and degrades performance. An agent should grant the absolute minimum permissions required to complete that specific assignment, and nothing more.

The challenging part arises when needing to demonstrate, according to our first principle, that work has been reliably completed, without revealing private information. According to the research , advanced cryptography can help address this, via techniques such as zero-knowledge proofs. Zero-knowledge proofs enable one AI agent to prove to the other AI agent that a planned computation was performed correctly, without revealing the data itself. For example, an agent tasked with analyzing a sensitive dataset can generate a succinct non-interactive argument of knowledge that proves a specific property of the result. This enables the delegator to instantly verify the validity of the proof.

Principles #4: Beware the zone of indifference

The zone of indifference is a term coined by Chester Barnard, an American business executive, in his 1938 book called The Function of the Executive. The zone is the space in which an employee will accept a task without questioning it. The task usually falls within their scope, so they unconsciously accept it. For example, if you’re a sales rep and your manager asks you to attend an upcoming pitch with a valued client, you probably wouldn’t push back or think too deeply about it.

As expressed in the research, current AI systems are defined by post-training safety filters and system instructions. As long as a request does not trigger a hard violation, the model complies. But when considering the emerging agentic web, this compliance might actually create a systemic risk. As mentioned in the research, “As delegation chains lengthen (? → ? → ?), a broad zone of indifference allows subtle intent mismatches or context-dependent harms to propagate rapidly downstream, with each agent acting as an unthinking router rather than a responsible actor.”

This has serious implications, because it means intelligent delegation requires “dynamic cognitive friction.” This means validating the information provided to agents to ensure that they are accurate, relevant, controlled and efficient.

This way, an agent can recognize when a request is ambiguous enough to warrant stepping outside their zone of indifference to challenge the delegator, or request human verification. Human participation and oversight similarly presume a degree of cognitive friction and active engagement, though this must be carefully managed, so as not to over-burden the users of the system. Human time is valuable and should only be invoked when necessary.

Looking ahead

At Google Cloud, our long-term goal is to integrate agents naturally and efficiently into organizations, which will mean delegating to and from human experts and respecting boundaries. Together, we believe this will deliver business value beyond what individual agents can handle.

Ready to navigate the agentic web? Read Google DeepMind’s report paper, Intelligent AI Delegation, on arXiv.

_{Note: A special thanks to Matija Franklin, Simon Osindero from Google DeepMind, and Vishal Agarwal, Andrea Morange from Google Cloud, for their contributions.}

Expanding Google Antigravity for enterprise customers

Thu, 20 Aug 2026 17:30:00 +0000

Since announcing Google Antigravity in Gemini Enterprise Agent Platform at I/O in May, we’ve heard helpful feedback from our customers. Your developers want easy access to coding agents across surfaces. Your enterprise governance team wants security controls and license management. And your finance team wants pooled usage so that no prepaid token ever goes unused. Now, everybody finally gets what they want:

Antigravity is available now as part of eligible Gemini Enterprise app subscriptions, including out-of-the-box administrative and spend controls.
New IDE extensions let developers use Antigravity in the IDEs of their choice, including VS Code.

Unify AI developer tools and enterprise-grade controls in one subscription

Equipping your developers with advanced agentic tools shouldn't mean managing separate add-on licenses, invoices, billing consoles or security settings. With AI developer tools included in Gemini Enterprise subscriptions, administrators can easily enable Antigravity and Android Studio for users with eligible Gemini Enterprise Standard, Plus, and Standard Emerging Market licenses, and maintain full governance with spend, security, observability and usage metrics consolidated in the Gemini Enterprise admin console.

Unblock your developers while controlling spend

With billing flexibility and cost management tools in Gemini Enterprise, you can ensure your developers have the resources they need while managing costs:

Granular spend thresholds: Administrators can set monthly project-level budget caps directly in the Billing console, with additional per-user and team controls rolling out later this year.
Pooled quotas: Shared token pools provide flexibility to high-demand teams, preventing purchased quota from sitting idle across the organization.
Overage enablement: To maintain continuous developer workflows when pooled quotas are met, administrators can opt into overages with monthly spend caps, smoothly transitioning excess usage to standard consumption-based rates.
Usage metrics: Centralized usage tracking provides visibility into token consumption, API calls, and developer activity, enabling organizations to continuously optimize their AI investments.

Safeguard your organization’s code and data with built-in privacy and security

Gemini Enterprise subscriptions bring Google Antigravity under Google Cloud’s standard security and compliance protections. Administrators and IT teams can set clear boundaries around workspace access, enable full audit logging, and enforce data privacy from a single console:

Configurable security policies: Enforce security and compliance controls, such as workspace sandboxing, and browser and MCP server access, to help ensure AI agents operate safely within authorized enterprise environments.
Central audit logging: Enable comprehensive audit logging with a single toggle, capturing prompts, agent responses, and metadata for compliance reporting.
Data privacy: Maintain data ownership under Google Cloud’s Terms of Service, ensuring all agent activity executes strictly within your secure cloud boundary.

Bring agentic coding directly into your team’s preferred development environments

Starting today your developers can use Antigravity across the surfaces they already know and use — including Visual Studio Code, Visual Studio (preview), Jetbrains (preview) and Zed IDEs (preview) via the new IDE extensions as well as the Antigravity 2.0 desktop app, and the Antigravity CLI.

Throughout all surfaces, administrators can enforce corporate identity standards while removing setup friction for technical teams via native support for Workforce Identity Federation (WIF) and Application Default Credentials (ADC).

AGY IDE extension demo

What our customers are saying

From rapid code generation to end-to-end task automation, Google Antigravity is giving engineering teams the momentum of cutting edge AI development backed by the stability, governance, and scale of Google Cloud. Here is how leading enterprise customers and partners are driving measurable outcomes in production:

“Deploying Antigravity in Gemini Enterprise allows Accenture to arm our engineers with Google DeepMind’s premier technology on the secure, trusted foundation of Google Cloud. Abstracting away operational complexity ensures our teams don't have to choose between developer speed and enterprise-grade governance — freeing them to deliver high-velocity engineering and transformative value for our clients.” — Chetna Sehgal, Global Practice Lead, Accenture Google Business Group

“At AirAsia and across the Group, we’re all about empowering our people. Bringing highly capable Gemini models directly into our daily workflows with Antigravity 2.0 does exactly that. We are putting the most advanced AI capabilities into the hands of our entire workforce, from software engineering to finance, marketing, legal, HR and much more. This empowers both our developers and critical back-office teams to innovate at an unprecedented pace and drive proven time-savings across the board.” — Nikunj Shanti, CTO, AirAsia Next

“Enterprises are moving beyond AI experimentation and expecting measurable business outcomes. With Gemini Enterprise and next-generation developer tools like Antigravity 2.0 and Antigravity CLI, we see significant opportunities to further embed agentic AI, particularly the advanced reasoning capabilities of Gemini models, directly into software delivery workflows. This goes beyond productivity as it enables faster decision-making, higher code quality, and reduced technical debt at scale. What stands out is how these capabilities are helping our teams evolve from writing code to orchestrating outcomes, strengthening every phase of the software development lifecycle while scaling innovation securely and responsibly.” — Rakesh Aerath, President, Asia Pacific Global Delivery Centers of Excellence, CGI

“Every developer workflow is unique, and agentic AI should adapt to the engineer, not the other way around. With Google Antigravity supported across developers' preferred IDEs, the desktop app, and the CLI, Cognizant can seamlessly embed agentic engineering across our global delivery centers. It gives our teams the freedom to choose their preferred surface while delivering high-velocity, secure software for our clients.”— Rajesh Varrier, President, Global Operations and Chairman & Managing Director, Cognizant India

“Antigravity has played a key role in advancing our AI-first strategy at Datamatics. Over the last few months, our teams have used it to rapidly build and deploy multiple applications, accelerate solution development, and embed AI into core business processes. From AI Impact Hub to analytics and sales enablement solutions, it has helped us move beyond experimentation to real execution, delivering measurable business outcomes while enabling teams to innovate faster and at scale.”— Vijay Venkatachalam, Vice President, Information Systems Group (ISG), Datamatics

"Embedding Google Antigravity's autonomous capabilities directly into Gemini Enterprise development environments allows our internal and Forward Deployed Engineering teams to automate complex tasks. Supported by the platform’s new FinOps and governance controls, our teams can confidently focus on orchestrating high-value, secure and cost-efficient outcomes for our clients at scale." — Faruk Muratovic, US AI & Engineering Strategy and Services Leader, Deloitte

“Adopting Antigravity places Wipro at the leading edge of the AI-driven software development lifecycle. Combining Antigravity 2.0, CLI, and the new IDE extensions with a seamless developer experience and superior code accuracy fits naturally into our AI-first engineering strategy. Working with Google Cloud allows us to accelerate software delivery and bring next-generation value to our global enterprise clients.” — Debashish Ghosh, Vice President and Global Head, Google Partnership, Wipro

Get started with Antigravity in Gemini Enterprise

Google Antigravity in Gemini Enterprise is available today for eligible Gemini Enterprise Standard, Plus, and Standard Emerging Market licenses, with broader support coming soon.

For administrators: Visit the enterprise setup guide to enable AI Developer tools for Google Antigravity and Android Studio.
For developers: Start building with Antigravity 2.0, the Antigravity CLI, or your preferred IDEs via Antigravity IDE extensions.

How AlloyDB ScaNN scales vector search to 10 billion vectors

Thu, 20 Aug 2026 16:00:00 +0000

To satisfy the demands of enterprise-grade agentic AI applications, underlying vector databases often struggle to scale effectively as modern use cases can scale to billions of vectors.

As a fully managed PostgreSQL-compatible database service, AlloyDB is engineered to handle demanding enterprise workloads. Combining Google's infrastructure with the reliability of commercial databases, it delivers high availability, scalability, and includes a cutting-edge analytical engine, optimal for agentic AI use cases. A key part of this is its ScaNN index, which now operates efficiently at a scale of 10 billion vectors. This was achieved through a major architectural enhancement: an innovative four-level tree (preview) paired with efficient memory usage.

The 10 billion vector scale challenge

Scaling to a 10 billion vector workload presents significant memory and computational challenges. Previous AlloyDB ScaNN tree-based index was limited to two- or three-level tree configurations, and attempting to scale those structures led to several bottlenecks:

Increased compute intensity: Larger tree structures demand significantly more operations for both index construction and query traversal.
Memory constraints: The sampling processes required for 10 billion vectors can easily exceed the system's available memory capacity.

Solution: Four-level architecture

The introduction of a four-level tree (preview) is the primary innovation in the recent AlloyDB ScaNN release. This architecture, illustrated in Figure 1, employs a top-down strategy to optimize the balance between accuracy and build efficiency. To maintain high performance and mitigate recall loss, the system integrates key enhancements such as Top-K branch, SOAR, centroid adjustment and balanced tree shape.

Figure 1. AlloyDB ScaNN four-level tree architecture

This design has two primary benefits:

1. Reduced compute intensity via hierarchical partitioning

The four-level architecture drastically reduces compute intensity by using hierarchical partitioning to restrict the volume of vectors scanned during a query. Instead of traversing a flat or poorly segmented space, the multi-layered hierarchy narrows down the search path exponentially. Figure 2 illustrates the search spaces across different tree levels, demonstrating how structural layering optimizes traversal efficiency:

Figure 2. Search space for two-, three- and four-level trees

Two-level: Utilizes coarse partitioning to guide queries, resulting in a basic search complexity of O(N^1/2).
Three-level: Introduces an intermediate layer to further subdivide clusters, narrowing exploration to O(N^1/3).
Four-level: Implements refined, highly granular partitions that optimize traversal efficiency down to O(N^1/4), sufficiently allowing for more than 10-billion vectors.

By dynamically expanding hierarchical layers as the dataset expands, AlloyDB ScaNN maintains ultra-low query latency and avoids computational scale walls from impacting performance.

2. Efficient memory usage

Achieving a 10 billion vector scale requires high memory efficiency. AlloyDB ScaNN uses these strategies to maximize memory management performance:

Balanced tree shape construction: The four-level tree utilizes a balanced configuration to circumvent memory limitations that restrict the size of training datasets. This balanced architecture effectively leverages reduced sampling sizes to construct high-fidelity tree partitions.
Sampling optimization: When the system encounters memory limitations, it generates a condensed sampling set that considers performance and accuracy.

Performance test results

By leveraging the innovative four-level tree architecture in our internal tests, we are able to achieve the following performance results:

AlloyDB can scale to over 10 billion vectors with its ScaNN index.
AlloyDB can deliver <= 51 ms p95 latency and 95% recall at 10 billion vectors with its ScaNN index.

Get started today

Experience AlloyDB ScaNN's four-level tree (preview) architecture today. You can deploy ScaNN for AlloyDB by following our quickstart guide to set up an instance. For optimized, high-speed vector search, refer to the official ScaNN documentation. New users can also explore AlloyDB through our 30-day free trial program. We can’t wait to hear about what you build!

10 questions every startup should answer before moving to production with their AI prototype

Thu, 20 Aug 2026 16:00:00 +0000

It’s never been easier to start an AI-powered startup on Google Cloud.

You grab an API key from Google AI Studio at breakfast, paste it into Antigravity, and by lunch you’ll have a nascent prototype of your product.

But it’s not all one straight line to progress. It's common to bump into these three challenges as you build out your stack:

A leaked API key racks up a large bill in 48 hours.
A "quick" migration from AI Studio to Gemini Enterprise Agent Platform stalls the roadmap for weeks because nobody on the team owns Identity and Access Management (IAM).
The launch works, until the app starts returning HTTP 429 Too Many Requests because of default per-project quotas, and there's no clean path to more capacity without paying a premium.

None of these are unique edge cases. . They're default failure modes of moving fast without a plan, and we've all done it at least once.

Below are the 10 questions every startup should be ready to answer before they scale, grouped into the three phases where decisions can shape your future:

Onboard (setting up your own projects and identities right)
Scale (getting more throughput without breaking the bank)
Govern (keeping costs, keys, and agents from running away).

These ten are scoped to the prototype-to-production transition itself. Each question ends with a short, runnable snippet you can copy into your own project today. Adjacent decisions that matter just as much but aren't specific to that move, your data layer and RAG architecture, CI/CD, network design, are deliberately out of frame here.

Onboard: get the foundation right (in the first hour).

#1 Where should I start: Google AI Studio or Gemini Enterprise Agent Platform?

Both surfaces expose the same Gemini family of models, but they solve different problems.

Google AI Studio (with the Gemini Developer API) is the fastest path from an idea to working code. A browser IDE, an API key, a generous free tier, and no cloud project to configure. It's where most ideas should start, and Google's own guidance says as much.
Gemini Enterprise Agent Platform (formerly Vertex AI) has the same Gemini models (plus 3rd party and OSS ones) with enterprise controls around them: IAM and service-account auth instead of raw keys, VPC Service Controls, Cloud Logging and Monitoring, reserved capacity, regional endpoints, and the compliance surface your first enterprise customer's security review will ask about.

The right answer for most startups is both, sequenced deliberately: first prototype in AI Studio, then migrate before you have real users. The danger for startups is treating them as interchangeable solutions, AI Studio's simple key model does not translate to enterprise controls, and Agent Platform's IAM model might look like overkill until the day it saves you from a stolen-credential incident.

It's less work than it sounds like.

The unified google-genai SDK targets both:

code_block: <ListValue: [StructValue([('code', '# Prototype: Google AI Studio, raw API key\r\nfrom google import genai\r\nclient = genai.Client(api_key="YOUR_AI_STUDIO_KEY")\r\n\r\n# Production: GEAP, no key — uses Application Default Credentials (ADC)\r\nfrom google import genai\r\nclient = genai.Client(\r\n vertexai=True,\r\n project="my-startup-prod",\r\n location="us-central1",\r\n)\r\n\r\nresp = client.models.generate_content(\r\n model="gemini-2.5-pro",\r\n contents="Summarize this contract in three bullets.",\r\n)\r\nprint(resp.text)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876cfc880>)])]>

#2 How do I set up a Google Cloud project without becoming an IAM expert?

The biggest reason startups stall on the migration to Agent Platform isn't the code, it's the operational leap from "here's an API key" to a cloud project with folders, service accounts, org policies, logging, and IAM bindings. If your team doesn't have a dedicated cloud admin, that first project setup can eat a week of engineering time.

Three moves cut that dramatically:

Use an opinionated project template instead of clicking through the console. The Cloud Setup checklist and the Google Cloud Architecture Framework give you a production-grade folder hierarchy (prod / non-prod / dev), a central logging + monitoring project, Security Command Center turned on, and baseline org policies, without you having to design them from scratch.
Enable the APIs you'll actually use, once. Batch it so you're not doing it project-by-project when you need it. The billing-link step is not optional. Every paid API you're about to enable will refuse to activate on a project with no billing account attached, so we handle that first.
Let Gemini pick the roles, but ask it for the narrow ones. You don't have to memorize the roles reference. In the Grant access dialog, Help me choose roles lets you describe the task in plain language, "this service account needs to call Gemini models and read one Cloud Storage bucket", and get predefined roles back with the reasoning shown. One catch worth knowing on day one: by default it suggests roles that cover common journeys, which usually means a service's Admin, Editor, or Viewer. Those are broader than you want. Say "least privileged" or "narrowest access" in the prompt and it returns granular roles instead. Same amount of typing, considerably smaller blast radius when a credential leaks.

Sources: Get predefined role suggestions with Gemini assistance

code_block: <ListValue: [StructValue([('code', '# One-shot: create a Vertex-ready project and turn on the services a\r\n# typical AI startup uses.\r\ngcloud projects create my-startup-prod --name="My Startup (prod)"\r\ngcloud config set project my-startup-prod\r\n\r\n# REQUIRED before enabling billing-dependent APIs (aiplatform, run, etc.).\r\n# Use `gcloud billing accounts list` to find your billing account ID.\r\ngcloud billing projects link my-startup-prod --billing-account=012345-6789AB-CDEF01\r\n\r\ngcloud services enable \\\r\n aiplatform.googleapis.com \\\r\n run.googleapis.com \\\r\n artifactregistry.googleapis.com \\\r\n logging.googleapis.com \\\r\n monitoring.googleapis.com \\\r\n secretmanager.googleapis.com \\\r\n cloudbilling.googleapis.com'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876cfc160>)])]>

Sources: gcloud services enable reference, · gcloud billing projects link (GA), GE Agent Platform environment setup.

If you're a solo founder, resist the urge to build in your personal GCP account. Create a proper organization or self-owned org first, then create the project inside it. That single decision can make everything else, fromIAM to billing and audit, dramatically easier.

#3 I'm on Google Cloud, how should my code actually authenticate: API keys, service accounts, or user credentials?

There's a hierarchy of safety here, and the easiest option is rarely the right one in production.

Raw API keys are fine for local prototyping. They are dangerous in production because they are long-lived, easy to leak into a client bundle or a public repo, and grant unbounded access until you notice.
User credentials via OAuth (application default credentials) are best for interactive tools, CLIs, and any code that runs on a developer's laptop.
Service accounts with least-privilege IAM roles are the right answer for anything running on a server, in a container, or in a scheduled job.

The pattern you're aiming for is one where your code never sees a key at all. It just calls the Google Auth library, which quietly reads Application Default Credentials (ADC) from the environment, a short-lived token minted for whichever service account is attached to your Cloud Run service, GKE workload, or Compute Engine VM. You get enterprise-grade auth without writing any auth code.

code_block: <ListValue: [StructValue([('code', '# On a developer laptop\r\ngcloud auth application-default login\r\n\r\n# On a server (Cloud Run, GKE, etc.) — no login, no key file.\r\n# Attach a service account with just the roles the app needs.\r\ngcloud run deploy my-agent \\\r\n --image=us-docker.pkg.dev/my-startup-prod/agents/api:v1 \\\r\n --service-account=agent-runtime@my-startup-prod.iam.gserviceaccount.com \\\r\n --region=us-central1'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876cfc1f0>)])]>

code_block: <ListValue: [StructValue([('code', '# Application code — notice: no keys, no secrets.\r\nfrom google import genai\r\n\r\nclient = genai.Client(\r\n vertexai=True,\r\n project="my-startup-prod",\r\n location="us-central1",\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876e15430>)])]>

Do one last favor to your future self: give that service account the minimum IAM role your workload actually needs, usually roles/aiplatform.user for calling models, not the broader admin roles. It takes an extra 30 seconds and prevents the credential from becoming a master key if it leaks.

#4 When should I actually stop procrastinating and migrate from AI Studio's API key to Agent Platform's IAM model?

Sooner than you'd like, and the correct trigger is not when it breaks. It's when any of these is true:

Your key has left your laptop (checked into a repo, pasted into a Slack, shipped in a mobile app).
You have more than one person on the team who needs to call the API.
You're spending more than a few hundred dollars a month.
You're about to onboard paying customers.

A potential pitfall that can catch growing startups off guard is simple: a leaked Gemini API key on an account that normally spends $180 a month gets scraped from a public repo and used to run distillation attacks, accumulating tens of thousands of dollars in charges before the owner even sees the first billing alert. The Google Cloud Shared Responsibility Model is unambiguous: the customer is liable for charges incurred with their own valid credentials.

The migration itself is genuinely smaller than the anxiety around it. In google-genai it's the two-line change shown in #1. What takes real time is the project setup around it, which is exactly why #2 exists.

Practical checklist for cutover day:

code_block: <ListValue: [StructValue([('code', '# 1. Revoke every existing AI Studio key that has ever left a laptop.\r\n# (Go to https://aistudio.google.com/apikey and delete them.)\r\n\r\n# 2. Confirm your production code has no api_key= arguments.\r\ngrep -rn "api_key" src/\r\n\r\n# 3. Enable GEAP and confirm ADC works locally.\r\ngcloud services enable aiplatform.googleapis.com\r\ngcloud auth application-default login\r\npython -c "\r\nfrom google import genai\r\nc = genai.Client(vertexai=True, project=\'my-startup-prod\', location=\'us-central1\')\r\nprint(c.models.generate_content(model=\'gemini-2.5-flash\', contents=\'ping\').text)\r\n"'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876e15160>)])]>

If step 3 prints a response, you're on Agent Platform.

Scale: get more capacity without paying a premium.

#5 Now that I'm shipping, why on earth am I getting all these HTTP 429 errors, and how do I make them stop?

429 Too Many Requests from Agent Platform almost always means one of two things:

You've hit the Dynamic Shared Quota (DSQ) ceiling for your project's tier. DSQ is a shared pool sized against your project's history, new projects start with modest limits by design, to prevent abuse across the platform.
You're calling a global endpoint during a global demand spike, competing with worldwide traffic for shared capacity.

The instinctive reaction is to file a quota-increase ticket. You can do that if you must, but two architectural moves usually solve the problem faster and cheaper.

Pin to a regional endpoint. Over half of startup traffic on Agent Platform defaults to global routing. Pinning to a specific region (say us-central1) sidesteps global contention and typically improves latency at the same time. (One narrow exception, which we'll get to in the next question: if you specifically want Priority PayGo, that feature currently only ships on the `global` endpoint. For everything else, pin regionally.):

code_block: <ListValue: [StructValue([('code', 'from google import genai\r\n\r\n# Global (default): competes against worldwide demand.\r\n# Regional: routes only to the regional cluster, less contention.\r\nclient = genai.Client(\r\n vertexai=True,\r\n project="my-startup-prod",\r\n location="us-central1", # <-- this is the one-line fix\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876d1ba60>)])]>

Add real retry and backoff. A 429 is a retryable signal, not a fatal error. Any production client should have exponential backoff with jitter. The modern google-genai SDK ships this behavior built in, but only if you actually enable it. This is easy to overlook. Don't reach for the classic `google.api_core.retry.if_transient_error` decorator you may have seen on older Vertex code. It's designed for the legacy exception classes and does not recognize the new `google.genai.errors.APIError, so it will silently pass 429s through without retrying. Use the SDK's built-in retry options instead:

code_block: <ListValue: [StructValue([('code', 'from google import genai\r\nfrom google.genai import types\r\n\r\nclient = genai.Client(\r\n vertexai=True, project="my-startup-prod", location="us-central1",\r\n http_options=types.HttpOptions(retry_options=types.HttpRetryOptions(\r\n attempts=5, initial_delay=1.0, max_delay=60.0, exp_base=2.0, jitter=1.0,\r\n http_status_codes=[408, 429, 500, 502, 503, 504],\r\n ))\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876e28c10>)])]>

How do you see this coming? Preferably not from a user telling you. Agent Platform publishes serving metrics to Cloud Monitoring, and there is a prebuilt dashboard you don't have to assemble: Console → Agent Platform → Dashboard → Model observability. It gives you requests per second, token throughput, first-token latency, and error rates out of the box.

The metric to actually alert on is aiplatform.googleapis.com/publisher/online_serving/model_invocation_count. It carries an error_category label with values of user, system, or capacity. Alerting on capacity isolates genuine throttling from your own bad requests, which a raw 429 count won't do.

One thing worth internalizing, because it trips people up: you cannot build a "warn me at 80% of my quota" alert for Standard PayGo. Under Dynamic Shared Quota there is no fixed per-project number to be at 80% of. A 429 means transient contention for shared capacity, not that you crossed a line. Percent-of-limit alerting only becomes meaningful once you're on Provisioned Throughput, which does expose real limit metrics.

code_block: <ListValue: [StructValue([('code', 'gcloud monitoring policies create --policy-from-file=capacity-alert.yaml'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18841977c0>)])]>

Sources: Agent Platform metrics list, Model observability dashboard, RetryOptions source, core retry_base.py, genai errors.py, reduce 429 errors, gcloud monitoring policies create, Dynamic Shared Quota.

Follow the Agent Platform rate limits documentation to understand what your project's current ceiling actually is before you assume you've outgrown it.

#6 Which consumption mode do I pay for: Standard PayGo, Priority PayGo, or Provisioned Throughput?

Three consumption models, three completely different workload shapes, and three completely different ways to proceed. Picking the right one can help startups see meaningful savings on AI bills. First let’s define them and then see when they are, or aren’t, a good fit:

Standard PayGo (DSQ): Pay per token from a shared pool; cheap, no guarantees.
Priority PayGo: Pay per token at a premium to jump the queue.
Provisioned Throughput (PT): Prepay for reserved capacity; predictable, use it or lose it.

Consumption type	Best for	Watch out for
Standard PayGo (DSQ)	Early-stage, low-QPS, spiky prototype traffic	429s during spikes; no reliability SLO
Priority PayGo	Bursty, revenue-critical traffic that can't tolerate 429s	Roughly 1.8x the standard token price
Provisioned Throughput (PT)	Steady, predictable, high-volume production traffic	Wasted spend if utilization is under ~40%; overflow to PayGo on spikes

The dominant startup mistake is buying PT too early. Usually this happens the week after a big launch when it feels like traffic will only ever go up. PT is reserved capacity. You pay whether you use it or not, and it only starts paying you back once your baseline is genuinely predictable, not just aspirational.

Here’s a pragmatic sequence:

Weeks one through four on Standard PayGo. Use it to measure your real request shape (tokens per minute at p50 and p99, request bursts, batchable vs. real-time split).
When you get your first bad 429 storm, flip on Priority PayGo for the traffic that actually matters. It's a config change, not a purchase order, nobody in procurement needs to be involved:

code_block: <ListValue: [StructValue([('code', '# Priority PayGo request: use the global endpoint + two extra headers.\r\nfrom google import genai\r\nfrom google.genai import types\r\n\r\nclient = genai.Client(vertexai=True, project="my-startup-prod", location="global")\r\nresp = client.models.generate_content(\r\n model="gemini-2.5-pro",\r\n contents="Rank these support tickets by urgency: ...",\r\n config=types.GenerateContentConfig(\r\n # Priority PayGo headers, per current GEAP docs.\r\n http_options=types.HttpOptions(headers={"X-Vertex-AI-LLM-Request-Type": "shared", "X-Vertex-AI-LLM-Shared-Request-Type": "priority"}),\r\n ),\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1884c311f0>)])]>

3. Once you can predict your baseline TPM, buy PT to cover the flat baseline and let anything above it overflow to PayGo. That's the combined pattern Google recommends for exactly this reason. Best of both worlds, not marketing spin.

Sources: Priority PayGo docs, google-genai HttpOptions source, GEAP REST reference.

#7 Which of my requests actually need to be live, and which should be batch jobs?

Most startup workloads are secretly batch jobs pretending to be real-time. Every one you move off the interactive path frees up DSQ headroom for the traffic that genuinely needs to be fast, the traffic where a user is actually watching a spinner.

Three questions to help you sort your traffic:

Does a human have to see the result within a second? That means: Live inference.
Can the user wait a few seconds and see a spinner? That means: Still live, but a candidate for streaming.
Would the user tolerate "we'll email you when it's ready" or "check back in a bit"? That means: Batch prediction.

Batch prediction on Agent Platform runs in a completely separate queue, does not consume your interactive DSQ, and is typically about half the price of on-demand inference. That's a rare double win: faster live traffic and a lower bill.

code_block: <ListValue: [StructValue([('code', '# Kick off a batch prediction job from a JSONL file in Cloud Storage.\r\n# Each line is one prompt; results land in another Cloud Storage prefix.\r\nfrom google import genai\r\nfrom google.genai import types\r\n\r\nclient = genai.Client(vertexai=True, project="my-startup-prod", location="us-central1")\r\n\r\njob = client.batches.create(\r\n model="gemini-2.5-flash",\r\n src="gs://my-startup-prod-batch/inputs/nightly-summaries.jsonl",\r\n config=types.CreateBatchJobConfig(\r\n dest="gs://my-startup-prod-batch/outputs/",\r\n ),\r\n)\r\nprint(job.name, job.state)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1884c312b0>)])]>

Common candidates: nightly document summarization, background classification of new signups, bulk translation, embedding backfills, evaluation runs against your test set. If any of those are on your live path today, moving them is often the single highest-leverage change you can make this week.

Govern: Keep costs, keys, and agents under control.

#8 How do I set spend caps that actually reduce cost, and not just send me polite emails while my bill triples?

Until recently the honest answer was that budgets only notify, and you had to build your own brake pedal. That changed in July. There are now three mechanisms, and you should think of them as layers.

A spend cap budget (Preview). Cloud Billing budgets can now enforce rather than just email. Set a spend cap on a project and, when usage costs cross 100% of the budget, Google pauses the service until you manually lift it. Agent Platform is explicitly on the eligible list, alongside the Gemini API, Cloud Run, and Cloud Run functions. Alerts still fire at 50% and 80%, so the pause isn't a surprise.

Three things to know before you rely on it:

Each cap covers one project and one eligible service. It is not account-wide protection. If you want Agent Platform and Cloud Run both capped, that's two caps.

Enforcement is not instant and is based on estimated costs. Overages past the cap are billed as normal, so set the number below your real ceiling. Lifting it is manual, and service resumption can take up to an hour. It also pauses Provisioned Throughput usage, so if you've prepaid for capacity, a cap hit stops that too.

It's in Preview as of publication, and the eligible-service list is documented as growing. Check the current list before you design around it.

2. A billing budget with a Pub/Sub trigger that disables billing. Still the right tool when you need blast radius the spend cap can't give you: multiple services at once, an entire project, or a service that isn't eligible yet. When the budget hits a threshold, Pub/Sub fires a Cloud Function that detaches the billing account, which stops all billable activity within minutes. Blunter and more dangerous than the native cap — it can leave resources unrecoverable — so reach for it second, not first. Full walkthrough: Automatically respond to budget notifications.

code_block: <ListValue: [StructValue([('code', '# Sketch: create a budget SCOPED TO ONE PROJECT that publishes to Pub/Sub at 50%, 90%, 100%.\r\ngcloud billing budgets create \\\r\n --billing-account=012345-6789AB-CDEF01 \\\r\n --display-name="my-startup-prod hard stop" \\\r\n --budget-amount=2000USD \\\r\n --filter-projects=projects/my-startup-prod \\\r\n --threshold-rule=percent=0.5 \\\r\n --threshold-rule=percent=0.9 \\\r\n --threshold-rule=percent=1.0,basis=current-spend \\\r\n --notifications-rule-pubsub-topic=projects/my-startup-prod/topics/budget-alerts'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18771a8e50>)])]>

Sources: Manage spend cap budgets, Set up programmatic notifications gcloud billing budgets create reference, Cloud Billing budgets concepts, Disable billing with notifications walkthrough, Programmatic notification payload schema.

Two things to get ahead of for, as the defaults can cause unexpected issues:

Limit your budget scope: Without --filter-projects, your budget applies to your entire billing account. A spike in any project will trigger the kill switch for everything.
Deploy locally: The budget notification doesn't specify which project is affected. To ensure the kill switch only affects the intended project, deploy your Cloud Function in the same project you're protecting (e.g., my-startup-prod).

Then wire up a tiny Cloud Function to that topic that calls projects.updateBillingInfo to unlink the billing account when the 100% threshold fires. That is your circuit breaker.

Mechanical ceilings via quota overrides. Even if you never set up the above kill switch, you can cap the rate at which cost can accumulate by setting explicit per-model, per-region quotas below the platform default. If your app never legitimately needs more than 500 requests per minute for gemini-2.5-pro, cap it there in the Cloud Quotas console; a leaked key can't burn what the quota flatly refuses to serve.

#9 Where should I actually keep secrets? (Not in .env files!)

The short answer is: Secret Manager. Not in environment variables, not in .env files, and never in your repo. Grant read access via IAM only to the service account that needs it.

code_block: <ListValue: [StructValue([('code', '# Store a third-party API key (Stripe, OpenAI, whatever).\r\necho -n "sk_live_xxx" | gcloud secrets create stripe-live-key --data-file=-\r\n\r\n# Grant only the runtime service account access to read it.\r\ngcloud secrets add-iam-policy-binding stripe-live-key \\\r\n --member=serviceAccount:agent-runtime@my-startup-prod.iam.gserviceaccount.com \\\r\n --role=roles/secretmanager.secretAccessor'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18771a8130>)])]>

code_block: <ListValue: [StructValue([('code', '# Application code fetches it at startup; nothing lives on disk.\r\nfrom google.cloud import secretmanager\r\nsm = secretmanager.SecretManagerServiceClient()\r\nresp = sm.access_secret_version(\r\n name="projects/my-startup-prod/secrets/stripe-live-key/versions/latest"\r\n)\r\nstripe_key = resp.payload.data.decode("utf-8")'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876ec7fa0>)])]>

Then two little disciplines that pay for themselves the first time you need them:

Rotation on a schedule and on suspicion. Secret Manager versions are cheap; treat them as immutable and roll forward.
Detection when a secret leaks. Secret Manager notifications and Google Cloud's Sensitive Data Protection can catch keys checked into a repo or pasted into a log stream, before an attacker does.

For any AI application that acts on a user's behalf, calls Gmail on their behalf, reads a Drive folder, hits a third-party SaaS with the user's credentials, do not store a long-lived token. Use OAuth 2.0 with short-lived access tokens and a refresh flow, so that when a user rage-quits or a compromised account gets revoked, the agent loses access at the same time.

#10 How do I stop my brand new AI agent from doing something it absolutely shouldn't?

An agent that can call tools, browse the web, or execute code needs the same defense-in-depth thinking as any other production service, arguably more, because it makes decisions that neither you nor the model can fully predict in advance.

Four layers, none optional once you have real users:

1. Identity for the agent itself. Give the agent its own service account, scoped only to the resources and tools it genuinely needs, the exact same least-privilege principle as any other workload. Agent Engine supports first-class agent identity so every action can be attributed to a specific agent instance in your audit logs.

2. Sandboxed code execution. If your agent runs generated code, a common pattern for data-analysis or "run this Python for me" flows, do not run it in your application process. Use an isolated sandbox so a bad combination can't touch your production data.

code_block: <ListValue: [StructValue([('code', '# Enable server-side code execution inside a sandbox for a request.\r\nfrom google import genai\r\nfrom google.genai import types\r\n\r\nclient = genai.Client(vertexai=True, project="my-startup-prod", location="us-central1")\r\nresp = client.models.generate_content(\r\n model="gemini-2.5-pro",\r\n contents="Compute the correlation between these two columns: ...",\r\n config=types.GenerateContentConfig(\r\n tools=[types.Tool(code_execution=types.ToolCodeExecution())],\r\n ),\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876ec7af0>)])]>

3. Prompt and response filtering. Model Armor sits in front of your model calls and screens for prompt injection, jailbreaks, sensitive-data exfiltration, and off-brand output, all of which are essentially guaranteed the moment you have real users being real users.

4. Behavioral monitoring. Security Command Center with threat detection flags anomalies in agent behavior, a service account suddenly calling an API it's never touched before, an agent reaching out to an unfamiliar external host, an unexpected spike in privileged operations. In near-real-time.

None of these are optional once your agent is acting on behalf of a real user or handling real money.

Your homework, so to speak:

Audit for raw API keys in your repo, your notebooks, and your production runtime. Rotate anything that shouldn't be there.
Move any workload that doesn't need a synchronous response to the Batch API.
Turn on the Model observability dashboard and put one alert on capacity errors, so the next 429 reaches you before it reaches a customer.
Set a spend cap on the project, and keep an eye out for 50% and 80% alerts. If usage crosses 100% of the budget, Google will pause the service until you manually lift it.

Do those four things this week and you're already ahead of most startups shipping AI features.

Have a scenario you'd like us to cover next? Reach us at Google Cloud for Startups.

How Box is unlocking multimodal enterprise agents with Gemini Embeddings 2

Tue, 18 Aug 2026 16:00:00 +0000

Enterprise content management is experiencing its biggest architectural shift since the cloud migration era.

For years, enterprises have stored trillions of gigabytes of critical data in Box: financial models, clinical trial protocols, M&A due diligence rooms, engineering schematics, and legal compliance playbooks. Up to this point, text-based search and retrieval-augmented generation (RAG) have successfully unlocked the vast narrative knowledge within these repositories, establishing a powerful and highly effective baseline for enterprise AI intelligence.

Traditional RAG architectures have mastered text processing, but the agentic era demands more. The next logical evolution is to extend this framework to capture the inherently multimodal, deeply spatial, and highly structured elements that exist alongside text. While text embeddings excel at indexing prose, multimodal architectures unlock a major new capability: For example, they preserve the strict row-column semantics of financial tables, interpret visual evidence like clinical data, and map the logic of multi-page flowcharts without losing their spatial layout.

To deliver next-generation capabilities that can handle the vast universe of digital content, Google Cloud and Box are integrating advanced multimodal capabilities into Box's Agentic Platform, powered by Gemini Multimodal Embeddings 2 merging Box’s industry-leading Intelligent Content Management platform with Google Cloud’s advanced AI embeddings.

Benefits of improved embedding: Extending the dimensions of document content

Preserving visual and spatial geometry: Complex document elements like multi-column tables or financial matrices rely on their spatial layout to convey meaning. Converting these elements into a flat string of text can disassociate column headers from their corresponding data points. Multimodal embeddings allow systems to interpret the document exactly as a human does, maintaining the integrity of spatial relationships.
Illuminating the visual modality: Enterprise documents are filled with visual indicators: technical charts, process flowcharts, branding assets, and product photography. Multimodal capabilities ensure that these elements are no longer invisible to search systems, allowing users to query images and text simultaneously.
Connecting hybrid file formats: Real-world business workflows rarely live in a single document format. An agent may need to cross-reference a PDF policy, a spreadsheet tracking log, and a presentation deck. Extending RAG with multimodal embeddings creates a unified understanding across these varied formats.

The Architectural Solution: Gemini Multimodal Embeddings 2

Google Cloud’s Gemini Multimodal Embeddings 2 introduces a unified, multimodal vector space capable of embedding text, raster images, document pages, rendered spreadsheet tables, and visual charts into the same semantic representation space.

Key product capabilities unlocked by gemini-embeddings-2:

Crossmodal retrieval (text-to-visual / visual-to-text): Enables natural language queries to retrieve highly specific visual components, such as locating a target chart or diagram within a massive library of slides, without requiring manual tagging.
Layout-aware document embedding: Rather than breaking files into arbitrary text blocks, the system can embed document page renderings directly, preserving visual hierarchies, callout boxes, and structural context.
Heterogeneous format bridging: Native support for seamlessly bridging content across .docx, .xlsx, .pdf, .pptx, .png, and .csv without losing modality-specific structural information.

Three core patterns of multimodal enterprise agents

By leveraging multimodal embeddings within Box, we have identified three uniqueprimary design patterns that illustrate how organizations can extend traditional RAG to support complex, visual workflows.

Pattern 1: Complex financial & analytical reporting

The challenge

Corporate finance, research, and audit teams analyze highly structured documents where vital data resides in embedded tables, growth charts, and footnote annotations. Text-only indexing can separate these numbers from their context, making automated analysis challenging.

The multimodal advantage

Structural alignment: The embedding model captures the physical structure of tables and charts, allowing financial agents to understand that a column header applies to a specific row of metrics.
Visual trend analysis: Agents can cross-reference written summaries with visual trends in accompanying bar or line charts, identifying and pointing out discrepancies between written claims and source data.
Contextual sourcing: Users can query complex portfolios and instantly retrieve the exact page, table, or chart supporting a specific metric.

Pattern 2: Multimodal clinical decision support & assisted diagnosis

The challenge

In healthcare and clinical environments, critical patient data is fragmented across vastly different, unstructured visual and textual formats — ranging from external physical photos (visual evidence) and microscopic pathology slides (lab reports) to structured risk matrices (triage grids). Traditional text-based systems or isolated analysis tools cannot synthesize these cross-modal relationships simultaneously, which can delay critical diagnoses or risk missing immediate, life-threatening procedural complications.

The multimodal advantage

Cross-modal clinical synthesis: Evaluates physical symptoms alongside cellular-level laboratory evidence simultaneously by indexing clinical photos, histopathology imagery, and triage grids into a single space.
Granular anomaly identification: Connects niche visual patterns under a microscope (like parasitic cyst walls) with medical knowledge to rapidly isolate rare conditions.
Risk-aware decision support: Cross-references findings against triage frameworks to deliver instant warnings about immediate patient risks, such as life-threatening anaphylactic shock.

Pattern 3: Cross-document multimodal synthesis & data reconciliation

The challenge

Enterprise information is fragmented across disconnected files and formats (e.g., PDF minutes, Excel charts, PNG flyers, and email threads). Traditional tools analyze these files in isolation, failing to connect the dots when verifying details or resolving data contradictions across independent documents.

The multimodal advantage

Cross-file synthesis: Connects information across entirely different formats (PDFs, spreadsheets, images, emails) simultaneously to answer complex business queries.
Conflict resolution: Flags and resolves contradictions between assets, such as catching outdated pricing on an image by cross-checking it against the latest financial spreadsheets.
Visual-to-text auditing: Audits visual or scanned files against text-based records (e.g., verifying a signed PDF contract against a legal review email) to catch missing clauses or changes.

The future of agentic enterprise content management

The integration of gemini-embeddings-2 into Box’s Agentic Platform is an important new capability to improve the next era of content intelligence. Multimodal embeddings help Box to move beyond basic search to active, intelligent collaboration.Box's Intelligent Content Management platform represents a fundamental shift in enterprise AI infrastructure — moving beyond passive document storage to deliver a governed, semantically indexed reasoning layer where AI agents can interrogate, cross-reference, and act on content with full compliance and security controls already in place.

Powered by multimodal embeddings and a suite of native AI agents spanning search, metadata extraction, research, analysis, and composition, Box enables organizations to proactively surface insights such as flagging stale pricing data, expiring contract clauses, or cross-document contradictions before they become business risks. For high-complexity industries like financial services, life sciences, and legal operations, Box's ability to reason across text, tables, charts, and images makes multimodal understanding a competitive requirement.

Designed to interoperate with the broader enterprise AI ecosystem, Box serves as the single governed content foundation that ensures every AI-driven workflow is grounded in authorized, auditable enterprise data.

When you think about it, the enterprise data landscape was always multimodal. Now we have the technology to make the most of it. By integrating gemini-embeddings-2, Box helps its users unlock unprecedented value from unstructured enterprise content. Product leaders who embrace multimodal-first architectures, rigorous precision benchmarking, and audit-ready grounding will lead the next wave of enterprise productivity and innovation.

The team would like to thank Ken Ikeda, Afshaan Mazagonwalla, and Samip Thakkar for their work on this project.

Building cost-effective, high-throughput gen AI workflows in Google Dataflow

Tue, 18 Aug 2026 16:00:00 +0000

Real-time streaming pipelines are the operational backbone of modern enterprises, continuously processing everything from customer support interactions to transaction logs. Traditionally, streaming DAGs are static; once deployed, their processing logic and execution paths are fixed. However, by integrating generative AI agents, we can move beyond static logic to adaptive execution. This allows streaming workflows to dynamically construct plans, query databases, and trigger custom remediation paths at runtime depending on the content of the data.

For example, when a customer sends an angry message about a damaged order, a pipeline shouldn't just log the error or flag a dashboard. It should look up the order in the database that holds customer order and inventory records, decide on a remediation action (like shipping a replacement or issuing a refund), email the customer, and log the final resolution.

However, streaming systems face a fundamental engineering hurdle when executing gen AI workflows: scale, latency, and cost. Sending every raw event directly to a heavyweight model or multi-step agent equipped with external database and email tools is prohibitively expensive, introduces high latency, and quickly exhausts API rate limits.

This pattern addresses the scale and complexity challenge by combining Google Dataflow, Google Cloud's fully managed, serverless execution service for Apache Beam, and the Agent Development Kit (ADK) to build a hybrid streaming pipeline. By using a lightweight, CPU-bound machine learning model upstream to filter and qualify events, we keep the pipeline highly cost-effective, routing only the complex cases to the downstream agent. There, the agent dynamically decides what actions to take, introducing dynamic branching to the stream without hardcoding thousands of conditional steps into the pipeline's static DAG.

A universal blueprint for high-volume streams

While we use a customer support triage scenario below, this pre-filter + agentic action pattern is a universal paradigm. It applies to any stream where a high volume (>9X%) of events are routine, and only a small number require complex, contextual reasoning.

IT Operations & DevOps: Filtering millions of routine system logs on CPU, and triggering an agent to run diagnostics and open bug tickets only when a critical anomaly is flagged.
Financial Fraud Triaging: Passing millions of transactions through lightweight, local rules, and calling an agent to execute multi-database lookup tools only for highly suspicious patterns.
Industrial IoT: Monitoring normal telemetry on the edge, and routing erratic spikes to an agent to coordinate equipment shutdowns and email field engineers.

The architecture: Why pre-filter streaming events?

In a high-throughput stream, the vast majority of messages do not require complex reasoning or remediation. They might be positive feedback, neutral inquiries, or simple queries.

Routing every single event to a heavyweight LLM workflow creates three primary bottlenecks:

API cost: Frontier models charge per token. Under high throughput, cost scales linearly with stream volume.
Latency: Multi-step workflows (which involve database lookups and external API calls) take seconds, creating a bottleneck in streaming DAGs.
Quotas: External APIs have strict rate limits that streaming workers can easily exhaust.

To prevent this, we build a pre-filtered pipeline in Apache Beam/Dataflow:

Pipeline flow

Ingestion: Read raw customer messages from Google Pub/Sub.
Lightweight sentiment classifier (CPU): Run all messages through a lightweight, CPU-based Hugging Face model (distilbert-base-uncased-finetuned-sst-2-english) using Apache Beam’s RunInference transform. This executes locally on the Dataflow worker CPUs, avoiding external API costs.
Pre-qualification Gate: A simple DoFn filters the stream. Messages with POSITIVE or NEUTRAL sentiment are acknowledged and dropped.
Automated Remediation (ADK): If and only if a message is classified as NEGATIVE, we trigger the gen AI agent backed by gemini-3.5-flash using the ADKAgentModelHandler. The agent uses tools to look up the user in BigQuery, fetch orders, choose a remediation plan, and send a notification email via the Gmail API.

Adaptive execution: Making the Beam DAG dynamic

In traditional streaming architectures, the pipeline's Directed Acyclic Graph (DAG) is rigid. Once deployed to Dataflow, the sequence of transforms is set. If you need to handle new types of alerts or change how specific events are routed, you have to modify, test, and redeploy the entire pipeline.

By placing a gen AI agent downstream of our sentiment pre-filter, we introduce a dynamic, adaptive node inside the static DAG.

For the 95% of records that are positive or neutral, the pipeline runs along a fast, static path. But when the filter gates a negative record, the agent evaluates the payload and dynamically selects the correct sequence of API tools (e.g., database query, inventory check, or email notification) at runtime. This allows the pipeline to execute complex decision trees dynamically, eliminating the need to build and maintain thousands of hardcoded conditional branches in the static Apache Beam code.

Implementing the pipeline

Here is an example implementation in Apache Beam using the Google Agent Development Kit (ADK) and the RunInference framework.

1. Defining the lightweight sentiment model

We define the upstream CPU model using HuggingFacePipelineModelHandler. This model classifies sentiment into POSITIVE, NEUTRAL, or NEGATIVE on the worker instance.

code_block: <ListValue: [StructValue([('code', 'model_handler = HuggingFacePipelineModelHandler(\r\n task="sentiment-analysis",\r\n model="distilbert-base-uncased-finetuned-sst-2-english"\r\n)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18769ff460>)])]>

2. Building the heavyweight ADK agent

The ADK agent acts as our remediation assistant. We equip it with three tools:

lookup_user: Queries BigQuery for the customer's email.
lookup_orders: Queries BigQuery for the customer's orders and current product inventory.
send_email: Sends a remediation email to the customer using the Gmail API.

code_block: <ListValue: [StructValue([('code', 'def make_adk_tools(project: str, dataset: str = "sentiment_demo"):\r\n def lookup_user(user_id: int) -> dict:\r\n """Look up user information (email address) from BigQuery by user ID."""\r\n from google.cloud import bigquery\r\n\r\n client = bigquery.Client(project=project)\r\n query = (\r\n f"SELECT user_id, user_email "\r\n f"FROM `{project}.{dataset}.users` "\r\n f"WHERE user_id = @user_id"\r\n )\r\n job_config = bigquery.QueryJobConfig(\r\n query_parameters=[bigquery.ScalarQueryParameter("user_id", "INT64", user_id)]\r\n )\r\n try:\r\n results = list(client.query(query, job_config=job_config).result())\r\n if results:\r\n row = results[0]\r\n return {"user_id": row.user_id, "user_email": row.user_email}\r\n return {"error": f"No user found with user_id={user_id}"}\r\n except Exception as exc:\r\n return {"error": str(exc)}\r\n\r\n def lookup_orders(user_id: int) -> dict:\r\n """Look up a user\'s orders and current product inventory from BigQuery."""\r\n from google.cloud import bigquery\r\n\r\n client = bigquery.Client(project=project)\r\n query = (\r\n f"SELECT p.order_id, p.product_id, pr.remaining_inventory, pr.price "\r\n f"FROM `{project}.{dataset}.purchases` p "\r\n f"JOIN `{project}.{dataset}.products` pr ON p.product_id = pr.product_id "\r\n f"WHERE p.user_id = @user_id"\r\n )\r\n job_config = bigquery.QueryJobConfig(\r\n query_parameters=[bigquery.ScalarQueryParameter("user_id", "INT64", user_id)]\r\n )\r\n try:\r\n results = list(client.query(query, job_config=job_config).result())\r\n orders = [\r\n {\r\n "order_id": row.order_id,\r\n "product_id": row.product_id,\r\n "remaining_inventory": row.remaining_inventory,\r\n "price": float(row.price),\r\n }\r\n for row in results\r\n ]\r\n return {"orders": orders}\r\n except Exception as exc:\r\n return {"error": str(exc)}\r\n\r\n def send_email(to_address: str, subject: str, body: str) -> str:\r\n """Send a plain-text email to the customer via the Gmail API."""\r\n import google.auth\r\n import googleapiclient.discovery\r\n import email.mime.text\r\n import base64\r\n\r\n try:\r\n creds, _ = google.auth.default(\r\n scopes=["https://www.googleapis.com/auth/gmail.send"]\r\n )\r\n service = googleapiclient.discovery.build("gmail", "v1", credentials=creds)\r\n\r\n mime_msg = email.mime.text.MIMEText(body)\r\n mime_msg["to"] = to_address\r\n mime_msg["subject"] = subject\r\n raw = base64.urlsafe_b64encode(mime_msg.as_bytes()).decode("utf-8")\r\n service.users().messages().send(userId="me", body={"raw": raw}).execute()\r\n return "Email sent successfully"\r\n except Exception as exc:\r\n return f"Failed to send email: {exc}"\r\n\r\n return [lookup_user, lookup_orders, send_email]'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18769ff430>)])]>

We configure the LlmAgent and package it in the ADKAgentModelHandler:

code_block: <ListValue: [StructValue([('code', 'adk_agent = LlmAgent(\r\n name="remediation_agent",\r\n model="gemini-3.5-flash",\r\n instruction=(\r\n "You are a customer service remediation assistant with access to "\r\n "BigQuery lookup tools and an email sending tool. "\r\n "When given a prompt describing a customer situation, follow the "\r\n "numbered steps exactly and use your tools to complete the task."\r\n ),\r\n tools=adk_tools,\r\n)\r\n\r\n# RunInference handler for the ADK agent\r\nadk_handler = ADKAgentModelHandler(agent=adk_agent)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1877658340>)])]>

3. Assembling the Dataflow DAG

The entire pipeline is declared cleanly. The upstream sentiment inference feeds directly into the filtering step (FilterNegativeADK), which then conditionally executes the downstream ADKInference:

code_block: <ListValue: [StructValue([('code', 'with beam.Pipeline(options=pipeline_options) as p:\r\n # 1. Read from Pub/Sub and classify sentiment on CPU\r\n sentiment_results = (\r\n p\r\n | "ReadFromPubSub" >> beam.io.ReadFromPubSub(topic=known_args.input_topic)\r\n | "DecodeMessages" >> beam.Map(lambda x: x.decode(\'utf-8\'))\r\n | "SentimentInference" >> RunInference(model_handler)\r\n )\r\n\r\n # 2. Filter out non-negative sentiment and invoke the ADK Agent\r\n _ = (\r\n sentiment_results\r\n | "FilterNegativeADK" >> beam.ParDo(FilterNegativeAndPromptADK())\r\n | "ADKInference" >> RunInference(adk_handler)\r\n | "LogADKResults" >> beam.ParDo(LogADKResponse())\r\n )'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f18772faac0>)])]>

Cost and performance advantages

By introducing this filtering step, we gain major engineering and operational advantages:

1. Significant cost reductions

Instead of paying for Gemini input/output tokens on 100% of incoming events, we pay only for the fraction that represent negative customer sentiment (typically < 5% of messages). The other 95% are classified locally on CPU instances at zero incremental API cost.

2. High streaming throughput

Dataflow distributes the CPU classification workload across many instances. Since CPU inference takes milliseconds, the pipeline scales horizontally to handle high-throughput event streams. The heavyweight LLM agent, which can take seconds per request due to tool execution, is called sparingly, preventing backlog.

3. Native Apache Beam integration

Adding the agent into the DAG requires no complex orchestration logic or manual thread pools. Using ADKAgentModelHandler with Beam's native RunInference transform handles parallel worker threads, batching, and integration automatically, keeping the codebase maintainable and clean.

Key takeaways

Streaming data is fast and high-volume, while heavyweight generative AI reasoning is slow and costly.

By building a pre-filtered pipeline with Google Dataflow and the ADK, you get the best of both worlds: the cost and speed of local CPU-based models, and the deep, automated capabilities of Gemini-backed agents.

To see the complete codebase and deploy this yourself, check out the next-2026-demo GitHub repository.

_{Apache Beam is a trademark of the Apache Software Foundation}

Building operational resilience with agentic AI in financial services

Tue, 18 Aug 2026 14:00:00 +0000

For financial institutions, operational resilience has long been embedded in regulatory and supervisory expectations — to say nothing of the high expectations of consumers. With the implementation of the European Union’s Digital Operational Resiliency Act (DORA), those expectations have become even more stringent, with more explicit, harmonized, and evidence-driven requirements. Firms must now demonstrate that their critical business services and supporting digital infrastructures can withstand disruption, support coordinated response, and recover with control.

To meet these conditions, Deutsche Bank developed an AI-powered agentic resilience platform that modernized its regulatory tabletop resilience exercises at scale and turned manual preparation into context-aware and evidence-ready simulations grounded in actual operational data. The platform builds enterprise context from architecture, data flows, logs, incident history, alerting signals, and operational telemetry to generate scenarios, simulated operational evidence, structured session records, and regulator-ready artifacts.

At many large banks with operations that span interdependent applications, data flows, and third-party services, this is a critical and even existential shift. Across financial services, supervisory expectations are evolving and as they do, banks’ tabletop exercises must reflect their production dependencies, real operating conditions, and compliance with consistent evidence standards more directly.

As Deutsche Bank considered how to successfully and efficiently make this shift at scale, it looked to its long-time partner, Google Cloud, and its growing suite of agentic AI tools.

From tabletop exercises to resilience intelligence

With its agentic resilience platform, DB has been able to transform its tabletop exercises from manual preparation to a continuous intelligence model. And it’s been able to extend the same agentic layer to root-cause analysis when real operational context is needed.

This means that every scenario it runs is based on real enterprise signals. The platform can then reflect true system dependencies, failure patterns, and business impact instead of relying on static inputs that are more likely to return assumptions than real-time insights.

By using Gemini Enterprise Agent Platform, DB has been able to migrate this operational context into structured scenarios with clear timelines, decision points, and expected responses. This has ensured that each exercise is grounded in real system behavior that produces consistent, audit-ready evidence that meets regulatory expectations.

Dual orchestration for control and flexibility

In order to deliver both regulator-grade control and operational flexibility, DB’s platform introduced a dual-orchestration architecture that separates workflows into two complementary execution models.

First, for regulator-aligned execution, the bank is using LangGraph to ensure that it generates every scenario through a traceable, deterministic process — with clear lineage from input context to output — that supports the auditability required for supervisory review.

Next, for its adaptive and investigative scenarios, DB is using Google Agent Development Kit (ADK) to enable agent-driven coordination. This approach allows the bank’s platform to dynamically analyze conditions and generate responses without predefined execution paths.

Figure 1. Architecture for context assembly, orchestration, and scenario generation.

With this architectural separation, the platform can combine governed execution with adaptive investigation while preserving a common intelligence layer. The same agents and tools can reason over architecture, data-flow diagrams, logs, and code artifacts across tabletop scenario generation and related incident-analysis workflows. Importantly, this supports a consistent resilience model across both planned exercises and real operational events.

Deutsche Bank’s objective with this platform was to engineer a resilience model for critical financial systems that meets regulatory expectations — even within highly complex, distributed environments. By linking dynamically generated scenarios to real business context and combining governed orchestration with adaptive analysis, the platform has given us an intelligent, continuously adaptive model for operational resilience.” – Sanjay Tripathi, Managing Director, Global Head of Surveillance Technology & Compliance Cloud & AI Transformation Lead, Deutsche Bank

Powering generation and governance with Google Cloud

Google Cloud’s suite of agentic tools is providing the foundation for scaling Deutsche Bank’s platform across its many governed, enterprise-grade resilience workflows. Here’s how:

Cloud Run supports elastic execution of scenario and evidence-generation services.
Gemini Enterprise Agent Platform transforms operational context into structured resilience scenarios.
Google ADK enables adaptive agent coordination.
Cloud SQL provides durable persistence for scenarios, session artifacts, and review records.

Collectively, these services give DB support for the traceable generation, controlled execution, and persistent evidence record required for compliance review and continuous improvement.

Scalable, evidence-ready resilience testing

Every scenario generated by Deutsche Bank’s platform drives a structured tabletop session for the teams that run response, escalation, and recovery. Because these exercises are grounded in real enterprise context, they reflect operational reality while also strengthening consistency across teams and creating audit-ready evidence that meets regulatory expectations. For institutions that operate under DORA or similar frameworks, this makes it easier to demonstrate controlled, coordinated, and disciplined response at scale.

This model is now being applied across multiple DB portfolios, which is helping the bank establish more consistent and scalable resilience paradigms and a replicable blueprint for the broader financial sector.

In this model, root-cause analysis acts as the feedback loop between real incidents and future resilience testing. The resulting insights from production events can inform future tabletop scenarios, while exercise outcomes can strengthen response playbooks, escalation paths, and recovery readiness.

All of this extends the platform’s value from planned resilience exercises to real operational events while keeping scenario-based resilience testing as the primary use case.

As adoption expands, this platform brings consistency by embedding Google Cloud’s methodology for context-aware resilience. It eliminates fragmented manual approaches and establishes a cross-functional, AI-informed operating model across the bank.

Toward resilience intelligence

The bank’s next step is to extend this approach into a broader resilience intelligence layer, which is possible because it can deploy the same patterns to support playbook refinement, recovery-readiness assessments, and continuous validation of controls against evolving system conditions.

For financial institutions, this is a strategic shift. As systems become more distributed and regulatory expectations more demanding, banks must move from periodic resilience testing to continuous, intelligence-driven capabilities. At Deutsche Bank, Google Cloud is making that transition simple across the organization.

Learn more about Google Cloud’s methodology for context-aware resilience in this article.

Using BigQuery Graphs with measures for trusted agentic workloads

Thu, 13 Aug 2026 17:00:00 +0000

When enterprises transition from using simple chat assistants to autonomous, agentic workloads, they quickly run into a hard truth: Agents are prone to inaccurate insights when working with directly raw tables.

BigQuery Graph helps organizations move beyond flat, static tables to represent enterprises exactly how they exist in the physical world: as interconnected business entities with real-world dependencies. With the support of measures in BigQuery Graph (preview), we are unifying governed metrics with relationship mapping. This allows your agents to reason across complex dependencies captured in graphs with precision of measures.

Why relationships matter

Traditional data structures are blind to multi-hop business context, causing AI agents to make incorrect operational decisions:

The concrete problem: If a retailer has an agent who is asked why winter jacket sales dropped 12% in Seattle, it can query flat tables to report the what (the 12% dip). But it fails at the why because it cannot trace the relational path: Seattle orders ➔ distribution centers ➔ suppliers delayed by regional storms.
The risk of disjointed systems: Lacking relationship context, the agent suggests an irrelevant 15% markdown campaign, needlessly eroding margins. Furthermore, maintaining separate systems - where one team maps supplier relationships in a separate graph database while another maintains SQL metrics - forces your agent to stitch these stacks together at runtime. This process is slow, expensive, and leads to inconsistent KPI calculations.

Measures in BigQuery Graph solves this by letting you map existing tables to a property graph in-place with zero ETL. This unified setup enables a logical evolution of inquiry:

Metadata grounding establishes what data you have.
Business metrics (measures) calculate how your business performed.
Relationship mapping (graph) uncovers why it happened.

Under the hood

Historically, standard SQL joins during graph traversals duplicate rows, leading to incorrect aggregation calculations. BigQuery Graph solves this natively.

Data modelers define a MEASURE (like SUM or AVG) directly within the Property Graph DDL. Using standard SQL via the GRAPH_EXPAND function and the AGG aggregator, the engine resolves the structural graph paths before evaluating metrics. This ensures your agent is smart enough to know when it needs a calculator (SQL) and when it needs a map (graph).

Because public projects like bigquery-public-data are strictly read-only, you must map the logical property graph inside your own project using a placeholder variable (YOUR_PROJECT_ID), while directly referencing the read-only public tables as nodes and edges.

code_block: <ListValue: [StructValue([('code', '-- 1. Map the graph inside YOUR project \r\n\r\n\r\nCREATE OR REPLACE PROPERTY GRAPH `YOUR_PROJECT_ID.YOUR_DATASET.thelook_ecommerce_graph`\r\nNODE TABLES(\r\n `bigquery-public-data.thelook_ecommerce.users` AS User\r\n KEY(id)\r\n LABEL User PROPERTIES(id, city, country),\r\n `bigquery-public-data.thelook_ecommerce.orders` AS Order\r\n KEY(order_id)\r\n LABEL Order PROPERTIES(\r\n order_id, \r\n MEASURE(AVG(num_of_item)) AS avg_items_per_order,\r\n MEASURE(SUM(num_of_item)) AS total_items\r\n )\r\n)\r\nEDGE TABLES(\r\n `bigquery-public-data.thelook_ecommerce.orders` AS OrderedBy\r\n SOURCE KEY(order_id) REFERENCES Order(order_id)\r\n DESTINATION KEY(user_id) REFERENCES User(id)\r\n LABEL ORDERED_BY\r\n);\r\n\r\n-- 2. Query your new graph with standard SQL—using standard {Label}_{Property} column outputs\r\nSELECT\r\n User_city AS city,\r\n ROUND(AGG(Order_avg_items_per_order), 2) AS agg_avg_items,\r\n ROUND(AGG(Order_total_items), 2) AS agg_total_items\r\nFROM GRAPH_EXPAND("YOUR_PROJECT_ID.YOUR_DATASET.thelook_ecommerce_graph")\r\nGROUP BY User_city\r\nORDER BY agg_total_items DESC\r\nLIMIT 10;'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876bd6c70>)])]>

Democratizing graph intelligence in BigQuery Studio

To make managing and deploying these relationship networks frictionless for both developers and business users, we have built native, intuitive operational tools directly into BigQuery Studio:

Visual graph modeler: A no-code, drag-and-drop interface inside BigQuery Studio that lets you visually build, edit, and map property graphs, nodes, and edges without writing complex DDL scripts manually.

Conversational Analytics (CA) integration: Users can interact with the graph naturally. Instead of guessing table joins, Conversational Analytics agents navigate the deterministic, relationship-aware map of the graph, converting natural language questions into precise, boundary-constrained GoogleSQL or ISO GQL queries. This prevents model hallucinations and enforces semantic consistency.

Unified semantics: Native Looker integration

To avoid maintaining fragmented logic stacks, business metrics must live at the data layer. By integrating Looker (LookML) natively with BigQuery Graphs as in-database analytic models, you define logic once at the core:

Database-managed models (sql_analytic_model_name): Point Looker directly to your database-defined BigQuery Graph using sql_analytic_model_name to map standard LookML dimensions and measures directly to your graph properties.
Looker-managed models (derived_analytic_model): Define your BigQuery Graph schema directly inside your LookML view using derived_analytic_model. Looker will dynamically generate and execute the SQL DDL statements to maintain the graph inside BigQuery.
Enterprise DevOps workflows: Manage your graph's entire lifecycle using the Looker IDE, Git-based version control, and Continuous Integration (CI). Core KPIs (like Churn Rate) remain completely identical, verified, and trusted.

Looker’s semantic layer governs Gemini Enterprise data for user trust

Tue, 11 Aug 2026 16:00:00 +0000

For organizations deploying AI agents at scale, there’s often a critical divide between structured and unstructured data. While large language models (LLMs) excel at parsing text documents, emails, and PDFs, they can struggle when presented with raw enterprise databases. Meanwhile, standard natural-language-to-SQL (NL2SQL) models often guess how database schemas fit together, which can lead to unpredictable queries, inconsistent metrics, and AI hallucinations that erode user trust.

Gemini Enterprise brings the best of Google AI to every employee through an intuitive chat interface that acts as a single front door for AI in the workplace. And now, Looker’s governed semantic layer serves as the trusted foundation for structured data within Gemini Enterprise, enabling trusted self-service business intelligence for all Gemini Enterprise users. With this integration, Looker analysts and admins can publish conversational agents natively into their Gemini Enterprise environments via the Agent-to-Agent (A2A) protocol. Now, organizations can provide their AI-accelerated taskforce with robust and trusted tools, powered by real-time analytics, that they can explore in natural language in addition to their daily workspace workflows. Making it easy to offer conversational agents in Gemini Enterprise expands discoverability and promotes a data-driven culture, while reducing friction to adoption.

Bringing a semantic foundation to structured and unstructured data

By combining Looker’s semantic layer with Gemini Enterprise, you can query both structured databases and unstructured documents in plain English, all in one place. Instead of jumping between dashboards and other tools to understand your numbers, teams can instantly connect hard metrics with real-world context to solve problems and make decisions faster.

Publishing Looker agents for consumption in Gemini Enterprise

Minimize AI hallucinations

If you ask the typical AI chatbot to calculate "revenue" or "churn rate" against an unstructured cloud database, it has to guess which tables to join, which filters to apply, and which timestamps to trust. This can result in different people asking the same question, only to get completely different answers.

Looker’s semantic layer eliminates this guesswork, serving critical context to Gemini Enterprise in the form of codified data, allowing the agent to give deterministic, predictable responses.

code_block: <ListValue: [StructValue([('code', '[ Gemini Enterprise Chat UI ] \r\n │\r\n (A2A Protocol / NLP)\r\n ▼\r\n [ Looker Governed Agent ] ──► Generates Deterministic SQL\r\n │\r\n [ Looker Semantic Layer ] ──► Business-Approved Definitions & Logic\r\n │\r\n ▼\r\n [ Enterprise Data Cloud ] ──► (BigQuery, AlloyDB, Spanner, etc.)'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f1876bbe670>)])]>

When a Gemini Enterprise user requests a business KPI in Gemini Enterprise, the request is routed directly to a Looker agent. The semantic layer generates deterministic, precise SQL based on version-controlled business logic. This helps ensure when an executive asks for "Revenue," they get the exact, governed enterprise metric — not a guess.

Robust governance and secure access management

Data governance and security are critical when introducing AI to enterprise data warehouses. Organizations can’t risk corporate information being loosely ingested, indexed, or exposed outside of strict permissions.

Looker’s integration with Gemini Enterprise is built on a zero-risk pass-through architecture, processing the data, but not writing to persistent storage. Gemini Enterprise does not ingest, replicate, or store your underlying database records. Instead, the integration operates safely and securely over the A2A protocol, following these core tenets:

OAuth authorization: In order to interact with a Looker agent within Gemini Enterprise, end users provide a secure, one-time OAuth consent. This binds their Gemini session to their specific Looker credentials.
Strong governance enforcement: Because the architecture relies on live pass-through queries, Looker’s existing row-level and column-level access controls are maintained.
Strict security isolation: If a user does not have permission to view, say, sensitive regional payroll or financial rows within the Looker platform, the Looker agent actively restricts that data in the Gemini environment. Should an agent be published to the Agent Gallery to simplify discovery, it still does not bypass the security controls that you established.

Technical capabilities and enterprise readiness

Deploying Looker agents natively into Gemini Enterprise via the A2A protocol doesn't just make it smarter — it makes it more interactive and interoperable, without sacrificing security. Here are some of the features you’ll find in this release.

Rich visual interactivity: support for charts

They say a picture is worth a thousand words. When users interact with Looker agents inside Gemini Enterprise, the platform goes beyond textual explanations and provides native, interactive data charts. If a user asks for a visual trend—such as monthly sales performance or regional distribution—the Looker agent maps the database response with rich, presentation-ready visualizations directly inside the universal chat box.

Note: If you published Looker agents in Gemini Enterprise prior to Looker release 26.12, we recommend updating or refreshing them to take advantage of these enhanced visualization capabilities.

Interoperability with first- and third-party agents

Looker agents published to Gemini Enterprise can understand context across different agents and data sources. Leveraging standard communication frameworks, these agents can securely share structured, governed insights with other first-party Google Cloud agents like the Deep Research Agent or external third-party agents to create structured workflows. This enables complex multi-agent orchestration, where an enterprise operational agent can pull data from a Looker agent to feed into a separate productivity or supply-chain workflow.

Looker-based user authentication

To preserve enterprise governance, this integration implements a robust, identity-centric authentication model. Users are required to provide a one-time OAuth consent, binding their active Gemini Enterprise session securely to their underlying Looker credentials. This helps ensure that every conversational query hitting your databases is authenticated at the user level, enforcing pre-existing Looker permission structures, row-level data access filters, and column-level masking rules — no exceptions.

Trusted data in Gemini Enterprise

The future of work is agentic. Gemini Enterprise provides a single, secure architecture to deploy a global digital task force,empowering your business with the best of Google AI for developers, employees, and customers.

The integration of Looker with Gemini Enterprise not only brings trusted data analytics to business users but also adds rich interactivity, visual charts, and data storytelling directly into their everyday workspace. As business users embrace this agentic new way of working, they aren't just getting text answers; they are getting presentation-ready visualizations that bring operational metrics to life and deliver complex insights.

To get started, learn how to publish your data agents in Gemini Enterprise to make your agent’s predefined context and analytics available to your entire organization.

How WPP operationalizes platform and data engineering for AI marketing

Mon, 10 Aug 2026 16:00:00 +0000

Between chaotic levels of market fragmentation and economic volatility, marketing and communications agencies can no longer rely on the human intuition they’ve traditionally used to win clients and optimize their ad spend. WPP is replacing that guesswork with an AI-powered view of shifting market dynamics, giving brands predictive certainty that lets them invest with confidence while moving at the speed of the market. That’s the value of WPP Open, its agentic marketing system.

But before it could begin applying sophisticated AI models to power those insights, WPP had to overcome a critical engineering challenge: the marketing data that made up the models was fragmented across hundreds of global agencies. While this dynamic made it nearly impossible to deploy AI tools efficiently and securely, access to models was only part of the equation. And until it built a reliable way to ingest, clean, and serve data to those models, WPP couldn’t unlock the true potential of generative AI.

To solve this, WPP partnered with Google Cloud to construct a unified data backbone and custom platform engineering path. Now, by standardizing its serverless compute patterns and data processing workflows, WPP is able to securely deploy targeted marketing campaigns in days instead of months.

Architecting a centralized, service-based data foundation

An important part of this effort was accelerating data availability and centralizing management. To do this, WPP adopted a service-based project structure for its current production environment. Rather than isolating every workload into separate silos, its engineering team centralized Google Cloud Storage (GCS) and BigQuery into dedicated, shared data projects, while also segregating the compute and processing workloads into distinct processing projects.

This structure simplified the core team’s user experience and ensured that all data consumers interacted with a unified source of truth. Because data from WPP’s various product lines lives in shared infrastructure, it was essential that security be strictly enforced at a granular level. By directly applying identity and access management (IAM) controls at the individual GCS bucket and BigQuery dataset levels, the company’s teams only see the data they’re authorized to access.

At the same time, raw data from various partners lands in dedicated GCS buckets in order to keep the raw inputs organized and isolated. From there, Managed Service for Apache Spark executes custom Apache Spark jobs to cleanse, normalize, and canonicalize information into standardized cohort definitions (SCDs). By utilizing a serverless architecture combined with Kubeflow for pipeline orchestration, WPP’s data engineering team avoided the overhead that often results from managing cluster infrastructure. This allowed them to focus entirely on the data transformation logic fueling the downstream GCS and BigQuery layers that ultimately feed the company’s audience & performance AI models.

What made our collaboration with Google Cloud successful was the balance they struck between uncompromising professionalism when it comes to best practices and timely delivery of incredibly pragmatic, real-world solutions.- Jonas DahlbaekSenior Data Engineering Lead, WPP

Standardizing data into unified cohorts

When raw data enters WPP’s processing zone, its platform converts it into SCDs that become core concepts used throughout the framework for keying purposes. These are based on five keys: age, gender, geo, product, and interest. But these underlying data definitions are fluid and continuously canonicalized to reflect evolving marketing concepts. As a result, this uniform structure allows WPP to join and aggregate data on a global scale without exposing sensitive underlying particulars or relying on shared identifiers.

The platform's core processing engine was built in type-safe Scala to ensure comprehensive visibility and compliance This custom framework tightly controls how data is transformed, and it inherently supports full source traceability while guaranteeing that every data point within the curated datasets can be traced back to its origin. This is a crucial level of traceability when building enterprise AI applications, as data scientists and auditors must understand exactly what information feeds into the models, even as WPP concurrently prepares to transition to Google Cloud Knowledge Catalog for automated, enterprise-wide data governance in the future.

Working with Google Cloud has been instrumental in accelerating and standardizing our engineering efforts. In a world where massive volumes of fragmented data present a daily challenge, having the right infrastructure is paramount to thriving in the AI age and helps our developers and AI marketers alike.
-Suleman KhanProduct Manager for OI & Google Partnerships, WPP

Standardizing the enterprise software lifecycle

For WPP, even with all these steps in place, processing data is only half the battle. To serve applications and manage the underlying infrastructure, the company’s platform engineering team developed a suite of reusable and centralized GitLab continuous integration and continuous deployment (CI/CD) templates. With this, WPP reduced the cognitive load on individual development teams and ensured that all deployments met strict corporate security standards.

These templates manage various enterprise workloads autonomously. The suite includes universal Cloud Run templates for full-stack web applications and batch data processing and scheduled pipelines. It also includes a deploy-only template for multi-stage workflows and a Cloud Run functions deployment template for event-driven microservices.

Implementing zero-rebuild promotion

Rebuilding container images in a production environment can introduce unnecessary risk and the potential for configuration drift. In order to maintain environmental consistency, WPP embraced a "build once, deploy many" methodology that applied cross-project IAM logic and Google Cloud Artifact Registry configurations.

As part of this process, developers build and test container images in the development environment. Once those exact, immutable container images are validated, they’re promote directly to production. This zero-rebuild promotion ensures total parity across deployment stages and eliminates unexpected production behaviors. The CI/CD templates also facilitate progressive traffic migration, which allowed teams to route a small percentage of traffic to new revisions before initiating a full rollout.

Immutable deployments. Traceable data. Unshakable trust. When you know exactly what goes into your AI, you can ship at the speed of light.
- Ranjith K PoldasAssociate Director , Devops (I&P), WPP Media

Automating security and intelligent networking

With this modern architecture, enterprise security acts as a foundational enabler for WPP, so it integrated Wiz security scanning directly into the pre-push phase of the CI/CD pipeline to catch vulnerabilities before code merges. The company also utilized Google Cloud Identity-Aware Proxy to enforce zero-trust access across its internal applications.

To further simplify operations, WPP adopted templates with intelligent virtual private cloud (VPC) logic. This configuration automatically identifies and resolves networking conflicts between legacy VPC connectors and modern Direct VPC access. This automated networking prevents deployment failures and accelerates the release cycle.

Monitoring operational health and driving ROI

Because a resilient platform foundation requires deep observability, WPP’s engineering team now monitors strict operational metrics instead of relying solely on deployment frequency. The team tracks request latency across p50, p95, and p99 percentiles, alongside 4xx and 5xx error rates. It also monitors container startup times to mitigate cold starts, while tracking overall CPU and memory utilization. This granularity ensures that both data pipelines and serverless infrastructure always remain highly available.

"Navigating a transformation of this scale across multiple complex workstreams—spanning data engineering, platform infrastructure, and AI integration—required more than just alignment; it demanded deep, mutual trust. Working as true partners, Google Cloud and WPP moved in lockstep to deliver production-ready platform capabilities on time."Yang Yue , Program Manager , Google Cloud

For WPP, operationalizing its data and AI stacks at this velocity provided the necessary infrastructure for its advanced workloads, and the business impact was clear and quantifiable. By building this dual foundation, the company reduced creative and strategy time from four weeks to just three hours. It also saw a 70% gain in production efficiency, a 33x increase in content volume, and a 2.8x increase in campaign return on investment. In short, by partnering with Google Cloud and implementing a broad suite of products and tools, WPP was able to quickly realize a significant ROI and boost productivity, efficiency, reliability, and security across the company.

How Malachyte solves retail’s cold-start problem with managed real-time AI

Mon, 10 Aug 2026 16:00:00 +0000

What’s the best way to recommend products to little-known users?

We’ve spent our careers trying to solve this problem for major companies like Spotify and Priceline, and it’s why Sidd founded Malachyte, an AI-powered ecommerce recommendation platform. These days, consumers have come to expect content that feels personalized and relevant, and online services competing for their attention have no choice but to do this exceptionally well.

Malachyte was inspired by some unique insights into how advanced AI models, and large language models in particular, could be applied in new ways to old challenges like personalization and recommendations.

As Malachyte set out to win potential customers’ business, we needed secure, scalable, reliable and, above all, leading-edge AI infrastructure to continue building the personalization algorithm we had always envisioned. By utilizing Google Cloud tools like Bigtable and Managed Service for Apache Kafka, Malachyte has been able to help some of its retailers double and sometimes even triple their sales.

This is the story of how we built it, and the ways any founder can use services like these to start deploying AI foundation models in new ways.

How Malachyte lifted sales for their users

For Malachyte, the aha moment was discovering that it could use neural networks with attention mechanisms — the same concept powering large language models — to personalize retail search and product pages. This approach is what enables LLMs to derive meaning from the relative order of items in a sequence, in their case the order of words and syllables in a sentence. When it comes to a retail website or app, what Malachyte wanted to capture was the sequence of customer interactions with the site.

What if we predicted the next thing a user wants on an ecommerce website just like LLMs predict the next word in a sentence?

A pre-GPT language model might have tried to look at a specific sequence of words or even fragments of words (what we now know of as tokens), but those earlier models wouldn’t examine what happens if the words were in the comparable order but weren’t contiguous or were re-arranged. The breakthrough came — in part through Google’s work on transformers — when LLMs gained the ability to understand complex and long-range dependencies within a sequence of items.

This more sophisticated method has delivered dramatic results — both for the proliferation of gen AI in general, and for Malachyte’s application of the technology.

To make this work in practice, Malachyte creates a vector of everything known about a visitor when they arrive on a site. Most users are visiting for the first time, so little is known about them. This is what’s known as the “cold start” problem. The trick is to use every interaction with a user to refine this vector. Each new addition to the vector, like a click or a query, does two things: it drives a prediction about the next thing the user wants, and it provides more information about the user.

Malachyte’s platform then updates the user vector and the prediction at the same time. This not only enhances the understanding of the individual user and their preferences, it also improves the overall model with the anonymized user data. With every inference, the context of both the average and the specific shopper grows.

The company further innovates by not just using attention-based neural networks but combining that with updating user profiles 100 milliseconds at time.

Malachyte’s recommendation and search agents populate the next page’s search results or recommendation carousels based on what users clicked on previous pages.

To be sure, this idea isn’t in itself new. Retailers have long used collaborative filtering recommendations systems to identify similar users and items that required massive sets of interaction history. These models typically required a lot of data, including third-party cookie-based profiles and demographics.

By focusing on the sequence of interactions in a session, retailers can achieve far more personalization — with less required data or spend — than by focusing only on a user’s profile. As a bonus, retailers can now offer their users more privacy by not relying on long-term cookie data.

This works because of the model structure and multimodal vectors that encode everything they know about a user, including browser data, click history and searches. The output, too, is multimodal: The same model can be applied to on-site search product pages, category pages, and add-to-cart carousels.

To make this work, each product in the catalog is embedded into the same space as the user vector, which gets updated and subsequently moves the vector closer to relevant products and further from those that aren’t. The neural network computing the embedding is being continuously trained across retailers who work with Malachyte, improving the quality for everyone. The system effectively becomes a data cooperative with each retailer's user helping make the model smarter for everyone.

A user session represented as a vector in a space of products.

To make this delivery for every user at every inference in 100 milliseconds, Malachite found real benefits in building onGoogle Cloud’s real-time AI stack.

With this system, every behavioral event streams into a Managed Service for Apache Kafka cluster. Rather than queuing for a future training job, each event immediately becomes an update to the user’s profile in Bigtable. The Kafka cluster allows the customer’s front-end to persist, so the user session signals quickly with little worry about how they fit into the user vector.

Bigtable allows Malachyte’s services to look up and update the right user vectors, and it and Kafka operate at the order of 10 milliseconds per step, which allows the entire recommendation loop to complete with no disruption to the user experience.

The three layer real-time AI architecture: a retailer’s website, Malachyte’s AI models and serving front ends, and context management infrastructure.

In addition to a fast core, a second layer of product catalog updates, inventory signals, and retailer-specific dimensional data keeps product data up to date. This flows through Cloud Pub/Sub, which offers globally accessible REST APIs that enable connections retailers can use without deep integration work. Malachyte agents run on Google Kubernetes Engine (GKE), with model inference on Google Compute Engine (GCE).

Continuous ingestion of external data, such as product catalog updates, operates through Pub/Sub’s global messaging system.

With its migration to Google Cloud’s AI architecture, Malachyte demonstrated that production AI inference and training are about more than GPUs and storage. They require real-time continuous learning infrastructure that includes a fast key-value store, a streaming layer, and a managed messaging system, all integrated with the foundation model architecture.

This approach also shows that even a small team like Malachyte’s can have a big impact in an industry. It just needs access to powerful infrastructure and core AI managed services.

Try it for yourself

Looking to shake up your industry or stay ahead of the competition like Malachyte? Try Managed Service for Apache Kafka, Cloud Pub/Sub, and Bigtable. New customers can receive $300 in Google Cloud credits.

Google named a Leader in The Forrester Wave™: AI Platforms, Q3 2026

Mon, 10 Aug 2026 16:00:00 +0000

At Google Cloud, we help organizations of all sizes build and operationalize complex agentic workflows with total confidence. By combining world-class AI research with an open, fully integrated AI platform, we give customers the flexibility to innovate and the foundation to deliver measurable business value.

At the center of it all is Gemini Enterprise, a unified platform designed to power the agentic enterprise, meet builders where they are, and deliver enterprise trust by default.

We believe this integrated approach is why Google has been named a Leader in The Forrester Wave™: AI Platforms, Q3 2026 report, and received the highest score in the Strategy category.

Powering the Agentic Era

As agents become embedded across every part of the business, organizations need a unified platform. Gemini Enterprise serves as the front door to AI for your entire organization, removing the silos between business users, developers, and IT leaders by connecting them all with shared, universal context.

Gemini Enterprise Agent Platform is the foundation that enables technical teams and IT leaders to safely, securely, and cost-effectively build and deploy production-grade agents. Any agent built in Agent Platform can be deployed across your entire workforce through the Gemini Enterprise app, putting custom agentic capabilities directly into the hands of every employee.

By unifying enterprise data, frontier model capabilities, developer tooling, and IT operations under one roof, Gemini Enterprise empowers teams to transform products, services, and complex agentic tasks while maintaining centralized control every step of the way.

See how Mars accelerates their marketing campaigns from months to weeks with Gemini Enterprise

Meeting builders where they are

No two development teams build agents in the same way. Some work in coding environments, others rely on low-code tools, and many organizations use a mix of models. Gemini Enterprise is built for that reality. We offer a platform tailored to every team's skill set, enabling high-code developers to build complex agentic systems while giving business and operational teams low-cod and no-code tools to rapidly design and test agent behaviors. And with access to over 200 native and third-party models, alongside pre-built agent templates, engineering teams can move from prototype to deployment with speed.

True enterprise AI should extend far beyond text. Gemini Enterprise is multi-modal by design, meaning it natively understands, reasons across, and generates text, code, audio, image, and video inputs in a single workflow. By securely connecting this multi-modal intelligence to your enterprise data wherever it lives, your engineering teams can turn this information into contextual business experiences.

See how Kohl’s uses Gemini Enterprise to turn data analysis into active conversations and deliver personalized customer experiences

Enterprise trust, built in

Trust is foundational to AI adoption, which is why Agent Platform is built with enterprise-grade governance, security, and observability by default. To help you scale with confidence, Agent Platform features built-in guardrails, continuous evaluation, and real-time tracking for costs, latency, and token usage. This operational transparency gives organizations the control they need to safely expand agentic workflows across the business. Builders can also leverage capabilities like Knowledge Catalog to establish a universal context engine across the enterprise, aggregating metadata with zero-copy federation to improve agent accuracy.

See how TELUS uses Gemini Enterprise to turn data silos into an Agentic Data Cloud, driving real-time, proactive customer experiences.

Looking ahead

We believe this recognition reflects our commitment to delivering an open, scalable, and powerful AI platform. As agentic systems reshape how enterprise software is built, Gemini Enterprise will continue to provide the foundation developers need to build with confidence.

Want to dive deeper into the report? Access the full Forrester Wave™: AI Platforms, Q3 2026 report here.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.

Your agentic summer: No-cost lessons from Google experts to build and scale agents

Thu, 06 Aug 2026 16:00:00 +0000

I’ve talked to developers, IT leaders, and builders who all ask the same question: How do we actually get agents into production?

The answer isn't theoretical — it's hands-on. Whether it’s designing a system that allows your agents to interact with external data sources while maintaining strict security guardrails or creating self-optimizing supply chain workflows or whatever you can think up, we’ve got you covered.

That’s why we’ve designed a path to help you take your AI ideas from a rough sketch to fully autonomous agents running in production. This summer, you can harness the same frameworks and approaches used by Google experts to build and scale agents — entirely at no cost.

Powered by Gemini Enterprise Agent Ready (GEAR), these hands-on labs and courses give you the blueprints and tools you need to deploy agents that ship.

Find your roadmap to future-proof your skills this summer, starting here.

1. Intro to AI Agents: Build a foundational understanding of how autonomous agents can redefine productivity.

2. Agent Fundamentals: Go under the hood of autonomous intelligence. Learn decision models and execution loops to deploy adaptive agents over rigid automation.

3. Enterprise Agents and Use Cases: Discover how AI agents drive real business impact. Map agents directly to corporate KPIs, solve operational bottlenecks, and utilize no-code to high-code frameworks.

4. Create Your First Gemini Enterprise Application skill badge: Earn a skill badge that proves you can create an app with Gemini Enterprise. You will master capabilities like deep research agents, multi-agent ideation, and Gemini Notebook for focused analysis.

5. Human-Centered AI: Keep humanity at the core of automation. Learn to strategically balance machine speed with human intuition for successful orchestration.

6. Agentic Strategy: Discover, Design, and Prototype: Prototype high-impact AI projects with zero code. Leverage Google’s transformation framework, map user journeys and build functional retail prototypes.

7. Orchestrate Multi-Agent Workflows with Gemini Enterprise skill badge: Demonstrate your ability to manage multiple agents powered by Gemini Enterprise with a skill badge. This skill badge shows that you can unify data across first- and third-party sources, develop multimedia marketing materials, and fully automate complex business actions across disjointed systems.

8. Engineer AI Agents with Agent Development Kit (ADK) skill badge: Build production-grade agents using expert developer tools. Earn a skill badge that proves you can perform live search grounding, build structured JSON schemas, and manage ADK pipelines.

9. Add Currency Tools to an Agent Using MCP: Connect your LLMs to external systems in just 20 minutes. Securely bridge agents with live external databases and deploy via CLI.

10. Manage Agent Memory and State: Give your agents a memory. Move beyond single-query replies and use session states with the ADK to build highly personalized, deeply contextual agents.

11. Create Agent Skills with Google: Infuse domain expertise into custom skills. Minimize AI unpredictability and build reusable workflows that optimize agent performance.

12. AgentOps: Operationalize AI Agents on Google Cloud: Harden your prototypes and scale safely to production. Implement observability, proactive monitoring dashboards, and robust CI/CD security.

Test your skills at the summertime Hackathon

Keep moving with agents! The All Things Agentic Hackathon is officially live.

The next leap in AI won't build itself — it needs you. Step up to the challenge with Gemini 3.5 and Google Cloud and deploy autonomous agents that do the heavy lifting in the background. Build what’s next, show the world what you can do, and compete for $180,000 in prizes, cash, and credits

Submissions are open from August 3, 2026 to August 31, 2026. Register here.

Join GEAR today

Don't wait for the summer to pass you by. Get hands-on with the tools, earn real-world credentials, and build in-demand skills, with confidence.

Ready to level up your agentic skills? Check out our two newest learning paths: Build High-Performance Multi-Agent Systems and Govern and Secure Enterprise Agents.

Learn more → Join GEAR today and start building.

Mirendil taps AI Hypercomputer TPUs and GPUs for pre- and post-training applications

Thu, 06 Aug 2026 13:00:00 +0000

Nearly every major AI lab uses Google Cloud infrastructure, including for training of models, inference for agents, and new frontier research. Google Cloud also continues to be the platform of choice for new, high-growth AI startups who are driving much of the industry’s research and innovation.

Today, we’re announcing that Mirendil, an exciting frontier AI lab focused on accelerating AI development, will also utilize Google Cloud’s AI Hypercomputer. This includes using a mix of Google’s TPU AI accelerators and full-stack NVIDIA AI infrastructure running on Google Cloud; this purpose-built AI infrastructure will support model pre-training and post-training applications for Mirendil.

The Mirendil team is building new AI systems that can help accelerate and democratize AI research and development. This means managing complex, end-to-end training workflows from initial model pre-training through post-training, and powering reinforcement learning on a massive scale. The ability to choose a mix of both TPU and NVIDIA’s full-stack accelerated computing platform through Google Cloud meant that Mirendil could access critical compute very quickly, and continue to match its workloads to the architecture best-suited to it over time.

We closely partnered with Mirendil on end-to-end design and deployment of combined TPU and NVIDIA AI infrastructure across compute, storage, networking, and control planes. We also collaborated on a system that uses managed training clusters running in Gemini Enterprise Agent Platform, which effectively streamlines the provisioning and management of both TPU and GPU environments for Mirendil. Mirendil is already live with a cluster of TPU v5P chips, with NVIDIA AI accelerated computing systems coming online soon.

"Progress in AI has been bounded by how fast humans can run the research loop - designing experiments, evaluating results, and iterating," said Behnam Neyshabur, cofounder and CEO of Mirendil. "We're building AI systems that can accelerate and improve that loop itself. Expanding on Google Cloud gives us the scale and flexibility to push those systems further and put frontier AI research capabilities in the hands of many more scientists and engineers to run that loop faster and at a greater scale."

You can read more about our partnership on Mirendil’s blog.