iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Google Cloud’s “Gemini agent” can mean either the Gemini Enterprise app or a custom agent deployed on Gemini Enterprise Agent Platform. The app works with configured connectors under applicable user and source permissions; a deployed agent accesses resources permitted to its agent identity or service account. Neither label alone tells you what a particular deployment can see: its connectors, identities, IAM grants, and enabled features do.
Which Google Cloud product do you mean?
The access model depends on the product. Gemini Enterprise is an app that can search or ground responses in configured business data sources. A custom agent deployed on Gemini Enterprise Agent Platform is a separate workload with its own identity and permissions.
| Product | Identity that shapes access | What to inspect |
|---|---|---|
| Gemini Enterprise app | The user’s identity and permissions in a connected source, alongside Gemini Enterprise IAM. | Enabled connectors, source permissions, app and data-store access, and project-level IAM. |
| Deployed Agent Platform agent | The deployed agent’s identity or the service account used to run it. | The agent’s identity, its IAM grants, connected tools and resources, and organization controls. |
Google’s documentation describes connectors for sources such as Google Workspace and selected third-party systems, but connector availability depends on the Gemini Enterprise edition and configuration. See the Gemini Enterprise app FAQs for the documented connector and edition context.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What can the Gemini Enterprise app access?
Configured sources, not an automatic view of every work account
An administrator configures connectors or data stores. The app can search or ground responses against those sources; merely using Gemini Enterprise does not mean it can see every file, mailbox, or business system in the organization. The FAQ lists Google Workspace sources such as Drive, Calendar, Gmail, and Groups, as well as systems including OneDrive, Outlook, SharePoint, Entra ID, ServiceNow, Jira, and Confluence. Which connectors are available depends on edition and setup.
#1 Best Overall
- Alexa can show you more - Echo Show 5 includes a 5.5” display so you can see news and weather at a glance, make video calls, view compatible cameras, stream music and shows, and more.
- Small size, bigger sound – Stream your favorite music, shows, podcasts, and more from providers like Amazon Music, Spotify, and Prime Video—now with deeper bass and clearer vocals. Includes a 5.5" display so you can view shows, song titles, and more at a glance.
- Keep your home comfortable – Control compatible smart devices like lights and thermostats, even while you're away.
- See more with the built-in camera – Check in on your family, pets, and more using the built-in camera. Drop in on your home when you're out or view the front door from your Echo Show 5 with compatible video doorbells.
- See your photos on display – When not in use, set the background to a rotating slideshow of your favorite photos. Invite family and friends to share photos to your Echo Show. Prime members also get unlimited cloud photo storage.
Workspace grounding respects the user’s source permissions
For Google Workspace grounding, Google says a user can only view and ground responses on information they are already authorized to access in the source Workspace application. Gemini does not grant new Drive, Gmail, or Calendar permissions. Access still depends on the user’s source ACLs and permissions, including the relevant group membership. See Google’s identity-provider configuration documentation.
Gemini Enterprise IAM is another gate
Source permissions are not the only boundary. Access to a Gemini Enterprise app and its data stores is also controlled by IAM. A user may need permission to both the app and the relevant data store. Resource-level policies can narrow access, but broad project-level roles can override intended resource-level restrictions. Administrators should check the effective permissions rather than assuming a restrictive setting on one resource is sufficient. Google documents these controls in its guide to granular access for apps and data stores.
Rank #2
- Alexa can show you more - Echo Show 5 includes a 5.5” display so you can see news and weather at a glance, make video calls, view compatible cameras, stream music and shows, and more.
- Small size, bigger sound – Stream your favorite music, shows, podcasts, and more from providers like Amazon Music, Spotify, and Prime Video—now with deeper bass and clearer vocals. Includes a 5.5" display so you can view shows, song titles, and more at a glance.
- Keep your home comfortable – Control compatible smart devices like lights and thermostats, even while you're away.
- See more with the built-in camera – Check in on your family, pets, and more using the built-in camera. Drop in on your home when you're out or view the front door from your Echo Show 5 with compatible video doorbells.
- See your photos on display – When not in use, set the background to a rotating slideshow of your favorite photos. Invite family and friends to share photos to your Echo Show. Prime members also get unlimited cloud photo storage.
Data Cloud connectors query under the user’s credentials
For documented Data Cloud connections such as BigQuery, Gemini Enterprise authenticates a user’s request using that user’s IAM permissions or OAuth 2.1 and queries the underlying source. A connector attached to an app is not necessarily restricted to one table or dataset: the authenticated user may be able to query every source resource their credentials permit. Administrators should verify the source identity’s actual reach and apply appropriate controls at the source. See Google’s Data Cloud connector documentation.
What can a custom deployed agent access?
A deployed Agent Platform agent uses the permissions granted to its agent identity or its runtime service account. Those grants determine which cloud resources and tools it can use; this is distinct from the permissions of the employee asking it a question. If a service account has broader access than that employee, the agent may be able to reach resources the employee cannot access directly. Google explains the options in Managing access for deployed agents.
Rank #3
- Google Nest Hub 1st Gen H1A – 7-inch smart display with Google Assistant built in for hands-free help, smart home control, entertainment, and daily organization.
- Korean Spec Model – International/Korean version of the Google Nest Hub H1A. Language can be changed to English after setup through the Google Home app/device settings.
- Smart Home Control – Use voice commands or the touchscreen to control compatible smart lights, cameras, thermostats, plugs, speakers, and other Google Assistant devices.
- Entertainment & Daily Help – Stream music, watch videos, view Google Photos, check weather, set timers, manage reminders, follow recipes, and get answers hands-free.
- Compact 7" Display Design – Great for kitchens, bedrooms, desks, offices, counters, and nightstands with a clean modern smart display design.
Grant the agent only the permissions its task requires, and audit them as you would other workload identities. Google also documents controls such as VPC Service Controls for supported Google APIs and services within a configured perimeter. Agent Platform governance documentation describes configurable capabilities including gateway policy enforcement and Model Armor inspection of prompts and tool responses; these should not be treated as guarantees that a control is enabled in every deployment. See Govern your agents.
How does grounding use work data?
Grounding connects a model response to specified data sources and can provide source support for an answer. It is not itself an access-control system. The user or agent identity, connector configuration, source permissions, and IAM policies determine which data can be reached; grounding operates within those boundaries. Google describes grounding in its Agent Platform grounding overview.
In practice, a response may use information from a configured source only if the request can access that information under the applicable identity and permissions. For the Gemini Enterprise app, that generally means checking the user and source access as well as Gemini Enterprise IAM. For a deployed agent, check the agent identity or service account and its grants.
Is work data used to train Gemini, and is it retained?
The answer depends on the specific Google Cloud service and its terms; statements about one Gemini product should not be applied automatically to another.
Best Value
- BUNDLE INCLUDES: Google Nest Hub Max with English, Spanish, French, Japanese and Global Language Compatibility so it works everywhere, Universal Power Adapter and Quick Start Guide with International Manual for Global Users
- IT WORKS EVERYWHERE Easy to use and will automatically start up in English when connecting to your device for the first time. The Nest Hub works globally with support for most languages and places internationally. And its language settings can always be changed back and forth to your preferred language anytime for international use or travel at your convenience
- BLENDS RIGHT INTO YOUR HOME Looks great on a nightstand, shelf, countertop - or the wall. This Nest Hub is small and mighty with bright sound that kicks! It plugs into the wall and is powered by the global ac adapter that works internationally so it works in outlets everywhere
Gemini Enterprise app
Google’s Gemini Enterprise FAQ says customer prompts, outputs, and data for its Business, Standard, and Plus editions are not used to train Google models or models for other customers. It also says Google does not sell customer data or use it for advertising. Those statements are tied to the named editions and service commitments in the Gemini Enterprise FAQ.
Agent Platform and feature-specific retention
Google’s Agent Platform zero-data-retention documentation says Google will not use customer data to train or fine-tune AI/ML models without prior permission or instruction. “Zero data retention” does not mean that no data is ever processed or retained: the documentation identifies limited scenarios. For Grounding with Google Search specifically, Google says it may retain query and log information not associated with a customer or end user for up to three days to debug systems supporting that feature. That stated duration concerns those specified logs and that feature, not every Gemini service or all customer data. Check the applicable Agent Platform zero-data-retention documentation and service terms for the deployment.
Gemini for Google Cloud is a separate scope
Google separately documents data use for Gemini for Google Cloud, including that prompts and responses are not used to train its models. Some Trusted Tester features can optionally share data for product improvement, not model training. This is a separate product scope, not a blanket statement about Gemini Enterprise or Agent Platform. See How Gemini products in Google Cloud use your data.
Recommended Free Tools
Administrator checklist: verify the actual access boundary
- Identify the exact product and edition: Gemini Enterprise app or a deployed Agent Platform agent.
- Inventory enabled connectors, data stores, and any tools the agent can call.
- For the app, verify user permissions and source ACLs, including group membership, then inspect access to both the app and data stores.
- Review project-level IAM as well as resource-level policies; check for broad roles that may defeat narrower restrictions.
- For Data Cloud connections, confirm which user credentials are used and which source resources those credentials can query.
- For deployed agents, inspect the agent identity or runtime service account and remove grants the task does not require.
- Review organization controls, audit practices, applicable service terms, and feature-specific retention behavior.
Public documentation cannot establish what a particular organization has enabled or granted. The answer for an individual deployment depends on its edition, connector setup, identities, IAM bindings, organization policies, enabled grounding features, and applicable service terms.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
