Gemini Code Assist Enterprise Security for Engineering Teams
Gemini Code Assist Enterprise gives engineers chat, code customization on private repositories and an agent mode that can use system tools and MCP servers. Google documents the data and network controls around it. This page reads those documents, shows where each control stops, and says when a team needs a second one.
Direct answer
Gemini Code Assist Enterprise security rests on Google Cloud identity and IAM, VPC Service Controls and Private Google Access for network boundaries, customer-managed encryption keys for code customization data, audit logging through the Cloud AI Companion API, IP indemnification, and a documented commitment that prompts and responses are not used to train Gemini models. Those controls decide who uses the service and where data goes. They do not judge whether one agent mode action, such as a tool call through an MCP server, should proceed, so high-impact actions need a separate approval step.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A platform team buys Gemini Code Assist Enterprise for four hundred engineers and turns on agent mode with an MCP server that reaches the ticket system and a deploy API. An engineer asks the agent to triage a failing release. It reads an issue comment that contains hostile text and calls the deploy tool with a changed target. Licensing was clean, the project sat inside a VPC Service Controls perimeter, and the vendor is covered by a data processing addendum. Nobody decided that this particular call was wrong.
How AgentShield handles it
Start with the Google controls for identity, perimeter, encryption and logging, because they cover who uses the tool and where data travels. Then route agent calls that reach systems of record through an AgentShield gateway. Rules check the arguments of each call, hold deploys, permission changes and bulk writes for a named approver, and write one attributed record of what was allowed, denied and approved.
The controls
The controls that secure which repositories, tools and cloud actions a Gemini Code Assist agent session may touch, and which wait for a named approver.
What Google documents for Gemini Code Assist security
The honest summary is that Google gives a Gemini Code Assist Enterprise customer its standard cloud identity, perimeter and data governance layer, and leaves the decision about each action the agent takes to the user and to your own tooling. The facts below come from the Google Cloud Gemini pricing page, the Gemini Code Assist overview and the page on how Gemini products use your data, read on November 11, 2026. Check the current pages and ask for written terms before you sign.
| Control | What the vendor pages say | Where it stops |
|---|---|---|
| Data use | Prompts and responses are not used to train Gemini models, and data is handled under the Google Cloud terms and Data Processing Addendum | A privacy commitment, not a limit on what the agent does |
| Network boundary | The overview lists VPC Service Controls and Private Google Access, and the docs have a VPC Service Controls setup guide | Where traffic travels, not which actions are allowed |
| Encryption | Customer-managed encryption keys are documented for code customization data | Protects stored index data, not agent behavior |
| Logging | The docs describe Gemini Code Assist logs and Cloud AI Companion API audit logging | Records activity, but you still need to define what is reviewed and by whom |
| IP protection | IP indemnification and source citations are listed for code suggestions | Legal cover for suggestions, not control over tool calls |
| Agent mode | Agentic chat completes multi-step tasks that use system tools and Model Context Protocol servers | The tools it can reach are the ones you configure |
Enterprise adds code customization on private repositories in GitHub, GitLab and Bitbucket, plus higher agent usage limits, over the Standard edition. The pages do not state a SOC 2 or ISO report for Code Assist itself, so ask for the compliance scope in writing.
Where Gemini Code Assist controls stop
None of these gaps is unique to Google. They are the normal shape of a control at the identity and network layer, where the decision is made before the agent reads the specific text that will steer it.
| Gap | Why it matters in a rollout |
|---|---|
| Agent mode acts with the access of the engineer and the tools configured for it | A broad MCP server or an administrator credential is handed to every step |
| Issues, logs and code comments are untrusted input | The agent reads them to do the job, and so can an attacker who writes to them |
| Perimeters are per project, not per call | An in-perimeter deploy and a harmless read look the same to VPC Service Controls |
| Audit logs are not an approval record | An auditor asks who approved a production change, which an activity log cannot show |
The same questions apply to the other agents your engineers may run, covered on Google ADK security, Amazon Q Developer enterprise security and the wider coding agents page.
Gemini Code Assist security checklist for US platform and security teams
- Choose Enterprise only for teams that need code customization on private repositories and the higher agent limits.
- Put the projects Gemini runs in inside a VPC Service Controls perimeter, following the Google setup guide.
- Use customer-managed encryption keys for code customization data if your policy requires them.
- Turn on audit logging for the Cloud AI Companion API and decide who reads it.
- List every MCP server and tool agent mode may reach, and give each least privilege credentials.
- Run a pilot, record which calls agent mode actually makes, and write rules from that list.
Steps one to five cost administration time. Step six is the one that needs a mechanism, and it is where teams look for a second control. Seat rates for both editions are on Gemini Code Assist Enterprise pricing.
Where a second control earns its place
An AgentShield gateway sits on the paths your agents use to reach systems of record, such as a deploy API, a ticket system, a database tool or a payment service. It does not replace Google controls. It adds a decision on each action, outside the model and outside the IDE.
| Risk | Google control | Second control |
|---|---|---|
| Wrong people use the tool | Licenses and IAM | None needed. Use the platform |
| Data leaves the boundary you want | VPC Service Controls and encryption keys | None needed. Use the settings |
| Injected text steers a tool call | Credential scoping, if you set it up | Rule on the target and arguments, held for a named approver |
| Agent calls a billing, identity or deploy API | Scoped keys, if you set them up | Count and amount limits per run and per day, approval above them |
| Customer data leaves in a tool call | None documented | Content scan on outbound arguments |
| Proof for a customer security review | Audit logs you configure | One attributed record of allowed, denied and approved actions |
The gateway works for calls you route through it, such as internal APIs and tools reached through an MCP endpoint. It cannot see actions that never leave the IDE, so least privilege credentials remain your control there. The enforcement mechanics are on tool permissions and the approval flow on human in the loop AI agents.
When to buy nothing, use Google controls, or add AgentShield
| Your situation | What to do |
|---|---|
| A few engineers use chat and completion only | Buy nothing beyond Standard. Agent mode is off or read-only |
| You need tailored suggestions from private repositories | Use Enterprise code customization |
| You need traffic kept inside a perimeter | Use VPC Service Controls and Private Google Access |
| Agent mode calls billing, identity, deploy or customer data tools | Add argument rules and approval on those calls |
| An auditor wants proof of who approved what | Add the gateway record |
Three of five rows end without a purchase from us. That is deliberate, because a control you do not need is not worth selling.
FAQ
Common questions about gemini code assist enterprise security.
Is Gemini Code Assist Enterprise secure?
Google documents VPC Service Controls, customer-managed encryption keys for code customization, audit logging, IP indemnification and a commitment not to train models on your prompts. Those cover data and network paths. They do not decide whether one agent mode action should run, so high-impact actions need a separate control.
How much does Gemini Code Assist Enterprise cost?
The Google Cloud pricing page lists hourly rates that work out to about $45 per user per month on a 12-month commitment and about $54 on a monthly commitment, billed monthly. Standard works out to about $19 and $22.80. Confirm current terms with Google before you sign.
Does Gemini Code Assist use my code to train models?
Google states that Gemini does not use your prompts or its responses as data to train its models, and that data is handled under the Google Cloud terms and Data Processing Addendum. Confirm that in your contract, and check retention terms for logs and customization indexes.
Can Gemini Code Assist agent mode be hijacked by prompt injection?
Any agent that reads issues, logs, code comments or web pages can be steered by hostile text in them. Narrow credentials limit what it can reach, but an approved call can still be misused. Rules on tool call arguments, with approval for risky actions, limit the damage when the model is fooled.
Does Gemini Code Assist support VPC Service Controls?
Yes. The overview lists VPC Service Controls and Private Google Access, and Google publishes a setup guide. A perimeter controls where data can travel between projects and services. It does not check what an approved agent session does inside the perimeter.
Does AgentShield work with Gemini Code Assist?
Yes, for tool and API calls routed through a gateway endpoint, such as internal APIs and MCP servers that agent mode uses, where it checks the arguments of each call and holds risky ones for approval. It does not replace Google controls and cannot see activity that stays inside the IDE.
More use cases