Tool note
Gemini on Vertex: The Enterprise Gap
What eats the schedule is not a missing control — it is that an API key has no subject, and the security review needs a named principal.
The prototype works. It was built against the developer API surface with a key in somebody’s own project, and a stakeholder wants it in front of customers. Then it meets procurement and a security review, and the schedule disappears.
The gap is rarely a missing capability. It is that three things you treated as environment turn out to be architecture: identity, data flow, and which model you are permitted to depend on.
Why this exists
The failure mode is a project finished in March and live in September, with no new features built in between. Most of that time goes on one thing nobody scheduled.
The prototype authenticated with a bearer key. An API key has no subject. It identifies a project, not a person or a service, so it cannot answer what a security review is actually asking: who called this, with whose data, and can you show me the record. The enterprise answer is an authenticated principal with least-privilege permissions and an exportable audit trail — and converting between them touches every call site, every environment, local development, CI, and the three scripts somebody wrote to test it.
That conversion appears on no plan, because it is not a feature. Put it on the plan, with a name and an estimate, before the review.
How to use it
Write the data-flow page before you answer a single questionnaire. One page: every field that leaves your boundary, where it is processed and stored, what is retained and for how long, what appears in logs, who can read them, and what deletion actually does. Most of the questionnaire is that page restated in someone else’s vocabulary. Without it you spend six weeks answering the same question in email in slightly different words.
Then ask for controls by category and get every answer in writing, dated: identity and least privilege, encryption with keys you hold, region pinning for processing and storage, controlled network egress, exportable audit logs, retention and training-use commitments in contract language, and committed capacity if you have a latency target. Do not take any resource page’s word for which of these exists today — including this one. That dated document is what you will be asked to produce in eighteen months.
Keep the model id in configuration, never in code. This line went from 3.0 to 3.8 in months, two 2.0 models are shut down, the 2.5 models are closed to anyone not already using them, and preview models carry at least two weeks of deprecation notice. Google’s own recommendation for new projects is gemini-3.5-flash-lite or gemini-3.8-flash. Any one of those facts makes a hard-coded model id a liability; together they make it a certainty.
The corollary that gets skipped: a twenty-item eval set you can run in one afternoon is what turns a forced model swap into a Tuesday instead of a quarter. Write it while the project is calm; nobody writes one during an incident.
And confirm the exact model id you depend on is available on the enterprise surface, in the region your review requires, before you promise a date. Availability is not uniform across surfaces or regions.
Where it goes wrong
Moving too early wastes the migration. If the prototype still changes weekly, the enterprise surface buys you nothing and you pay the move twice. Go when the shape is stable.
Controls describe the pipe, not the behavior. Region pinning, customer-managed keys and a signed agreement say nothing about whether the output is accurate. A data-processing agreement is not an AI policy, and a review that passes is not permission to skip evals.
Do not let the review become the project. The posture has a floor set by the data class. Public marketing copy does not need what patient data needs, and applying the strictest posture everywhere is how a two-week integration becomes a quarter.
And if you cannot get the retention and training-use answers in contract language, that is your answer for regulated data. Escalate it as a decision for somebody with authority, not a blocker to engineer around.
Copy and Clear become available when the worksheet is ready.
ENTERPRISE-SURFACE READINESS - QUESTION LIST
System: Data class: public|internal|confidential|PHI|PCI
Owner: Target live date:
Rule for this whole sheet: an answer is not an answer until it
is in a document, with a source and a date. "Someone said yes
on a call" is not an answer.
- THE DATA-FLOW PAGE (do this first; it answers most of the rest)
Fields leaving my boundary name every one; no "etc."
Fields I could remove first
Processing location
Storage location
Retained by the vendor what, how long, where stated
Retained by me what, how long, where stored
In my logs prompt? output? identifiers?
In the vendor's logs
Who at the vendor can read it
Sub-processors
What deletion actually deletes and the lag before it does
Diagram reviewed by on
- IDENTITY - THE ITEM THAT EATS THE SCHEDULE
- Current auth: API key | service principal | federated
- Key-to-principal conversion estimated:
- Call sites to change:
- Environments to change (incl. local dev, CI):
- Rotation: owner , interval , tested
survives into the audit log.
say who caused it and what data it carried."
- CONTROLS TO CONFIRM IN WRITING (ask by category, not by name)
For each: capability? source date
a. Authenticated principal + least-privilege permissions
b. Encryption at rest with keys I control
c. Encryption in transit + minimum TLS version
d. Region pinning: processing
e. Region pinning: storage and any caching layer
f. Private / controlled network egress from my environment
g. Audit logs, exportable to my own log store
h. Retention setting for prompts and outputs
i. Written commitment on training use of my data
j. Sub-processor list + change notification terms
k. Committed capacity or throughput option
l. Incident notification window, in hours
m. Contractual uptime terms and the remedy
n. Deletion on termination, with evidence
Anything above marked "roadmap" is a NO for planning purposes.
- MODEL DEPENDENCY (short half-life; plan for it)
- Model id is in config, not code. Current:
surface, in region . Confirmed
- Fallback model chosen and tested:
If I am, the notice period is short - fallback is .
- Eval set exists: items, runs in , owner
- Last full re-qualification run:
- Deprecation notices go to a monitored address:
notice. What do I do on day one?"
- WHAT THE REVIEW WILL ASK THAT ENGINEERING DID NOT PLAN FOR
and what can it cause?
run as code, or used in a query?
do without a human.
- Human review step for , owned by .
- PROCUREMENT MECHANICS (stalls here are not technical)
Named approver, security
Named approver, privacy / legal
Named approver, budget
Existing agreement to amend, or new?
Questionnaire format expected
Date the questionnaire was received
Date the data-flow page was sent
Open items blocking sign-off
Next checkpoint
- STOP CONDITIONS
language, and the data class is regulated -> escalate as a
decision, not an engineering problem.
the model or change the promise, before the date is set.
the data class agreed in writing first. That conversation
is cheaper than the controls.