This document describes how to enable Model Armor for Gemini Enterprise. Model Armor is a Google Cloud service that enhances the security and safety of your AI applications by proactively screening the prompts and responses given by the Gemini Enterprise assistant. This helps protect against various risks and ensures responsible AI practices. Model Armor is supported on all Gemini Enterprise editions at no additional cost.
Model Armor does not remove or alter personally identifiable information (PII) or mask sensitive data. However, Gemini Enterprise blocks any response from the Gemini Enterprise assistant that triggers Sensitive Data Protection (SDP) filters.
Model Armor's response to potential issues in user queries or responses from the Gemini Enterprise assistant is governed by the template's enforcement type. For more information, see Define the enforcement type.
If the enforcement type is Inspect and block, Gemini Enterprise blocks the request and displays an error message. This is the default enforcement type when you create a Model Armor template using the console.
If the enforcement type is Inspect only, Gemini Enterprise does not block the requests or responses.
When the Model Armor screening service is unavailable, you can configure Gemini Enterprise to behave in one of the following ways:
| Mode | Description |
|---|---|
| Allow user interactions | In this mode, Gemini Enterprise allows requests and responses to pass through without proactive screening when the Model Armor screening service is unavailable, ensuring continuous communication with the end-user. However, this can occasionally expose unscreened messages or provide answers to unscreened queries. |
| Block all user interactions | In this mode, when the Model Armor screening service is unavailable, Gemini Enterprise blocks all requests and responses, including legitimate ones. |
Before you begin
Make sure you have the required roles assigned to you and the service account:
To enable Model Armor in Gemini Enterprise, you need the Gemini Enterprise Admin (
roles/discoveryengine.agentspaceAdmin) role.To create the Model Armor templates, you need the Model Armor Admin role (
roles/modelarmor.admin).To call the Model Armor APIs, you need the Model Armor User role (
roles/modelarmor.user).