10 Questions to Answer Before Your AI Prototype Hits Production

So you’ve got an AI prototype that’s ready to leave the cozy swamp of development and swim into the wild currents of production. It’s an exciting time, but as any capybara knows, the open water has its own set of predators. Before you dive in, make sure you can answer these 10 questions—they’ll keep you from becoming caiman chow.

Onboard: Get the Foundation Right

1. Where Should I Start: Google AI Studio or Gemini Enterprise Agent Platform?

Both give you access to the same Gemini models, but they’re built for different stages of your journey. Google AI Studio is your quick-start launchpad—grab an API key, start prototyping in minutes. The Gemini Enterprise Agent Platform (formerly Vertex AI) is the production-grade vessel with IAM, VPC controls, and compliance features.

The smart play? Use both, in sequence. Prototype in AI Studio, then migrate to the Agent Platform before you have real users. The google-genai SDK makes the switch a two-line change.

2. How Do I Set Up a Google Cloud Project Without Becoming an IAM Expert?

IAM can feel like a swamp of confusing roles and permissions. But you don’t need to become an expert—just use the right tools. Start with the Cloud Setup checklist and the Architecture Framework for a solid folder hierarchy. Enable the APIs you need in one batch, and let Gemini pick your roles—just ask for the “narrowest access” to keep your blast radius small.

3. How Should My Code Authenticate?

Raw API keys are fine for local tinkering, but they’re a liability in production. Use user credentials for developer laptops and service accounts with least-privilege IAM roles for anything running on a server. The goal is to have your code never see a key at all—let the Google Auth library handle it via Application Default Credentials.

4. When Should I Migrate from AI Studio to the Agent Platform?

Don’t wait for something to break. Migrate when any of these are true: your key has left your laptop, you have more than one developer, you’re spending more than a few hundred dollars a month, or you’re about to onboard paying customers. The migration itself is small—the setup around it is what takes time, so plan accordingly.

Scale: Get More Capacity Without Breaking the Bank

5. Why Am I Getting HTTP 429 Errors, and How Do I Stop Them?

429s usually mean you’ve hit the Dynamic Shared Quota ceiling or you’re using a global endpoint during a demand spike. Two fixes: pin to a regional endpoint (like us-central1) and enable the SDK’s built-in retry with exponential backoff. Also, set up alerts on the capacity error category in Cloud Monitoring so you know about throttling before your users do.

6. Which Consumption Mode Should I Pay For?

You have three options: Standard PayGo (cheap, shared pool), Priority PayGo (premium for bursty, critical traffic), and Provisioned Throughput (reserved capacity for steady, predictable loads). Most startups buy Provisioned Throughput too early—wait until you have a predictable baseline, then use a combination of PT for the baseline and PayGo for overflow.

7. Which Requests Need to Be Live, and Which Should Be Batch?

Many workloads are secretly batch jobs in disguise. If a user can wait a few seconds or doesn’t need an immediate response, move it to batch prediction. It runs in a separate queue, doesn’t eat your interactive quota, and costs about half as much. That’s a win-win for your latency and your wallet.

Govern: Keep Costs, Keys, and Agents Under Control

8. How Do I Set Spend Caps That Actually Work?

Budgets that just send emails are like a capybara that warns you about the caiman but doesn’t move—useless. Now you can set spend cap budgets that pause the service when you hit 100%. For broader protection, use a Pub/Sub-triggered Cloud Function to detach billing. And don’t forget quota overrides—they’re a mechanical ceiling that can stop a leaked key from burning through your cash.

9. Where Should I Keep Secrets?

Not in .env files, that’s for sure. Use Secret Manager for all your API keys and credentials. Grant access via IAM only to the service accounts that need it, and set up rotation and detection to stay ahead of leaks.

10. How Do I Stop My AI Agent from Doing Something It Shouldn’t?

Your agent needs the same defense-in-depth as any production service. Give it its own service account with least-privilege, sandbox any code execution, filter prompts and responses with Model Armor, and monitor behavior with Security Command Center. These aren’t optional once your agent acts on behalf of real users.

Your Homework

Before you swim into the deep end, do these four things:

• Audit for raw API keys in your repos and rotate anything suspicious.
• Move non-critical workloads to the Batch API.
• Set up the Model observability dashboard and alert on capacity errors.
• Set a spend cap on your project and watch those alerts.

Do these and you’ll be ahead of most startups. For more, check out our Google Cloud review and other platform reviews to keep your stack solid.

Original announcement published on Google Cloud.