Govern Gemini Enterprise at Scale with BigQuery

Rolling out the Gemini Enterprise app across your org is a huge leap for productivity—think agentic AI, search-grounded assistants, and NotebookLM. But as adoption swells, so does the need to audit, govern, and extract insights from a tidal wave of telemetry. Google Cloud’s out-of-the-box dashboards are great for a quick look, but for deep-dive forensics, you need BigQuery. Let’s dive into how to set up a pipeline that turns raw logs into actionable intelligence.

Why BigQuery + Gemini Enterprise is a Game-Changer

By routing Gemini Enterprise logs into BigQuery via log sinks, even a lean admin team can:

• Profile nuanced adoption: Segment usage by department, track custom agent building, and calculate agent-to-employee ratios.
• Quantify value: Combine conversational logs with HR data to calculate hours saved and build executive dashboards.
• Execute compliance audits: Audit grounding queries across Google Drive and enterprise directories to prevent data leaks.
• Investigate safety alerts: Query historical logs when Model Armor flags a prompt, identifying the exact text that triggered a block.

The telemetry lands in five BigQuery tables, each capturing unique data fields:

• Gen AI User Messages – verbatim prompt inputs
• Gen AI Choices – model responses, finish reasons, reasoning steps
• User Activity Telemetry – IAM emails and grounding file paths
• Cloud Audit Activity – control plane config changes
• Cloud Audit Data Access – data plane interactions and search queries
• Aggregate OOB Metrics – pre-aggregated seat and engagement data (batch export)

Setting Up the Ingestion Pipeline

No complex custom code needed. You’ll set up a Cloud Logging Log Router Sink for conversational logs and an async batch export API for aggregate metrics.

Streaming Pipeline (Detailed Logs)

Stream row-by-row conversational data. Ensure prompt and response logging is enabled in your Gemini Enterprise Admin Console. Use this inclusion filter (replace [PROJECT_ID]):

logName="projects/[PROJECT_ID]/logs/discoveryengine.googleapis.com%2Fgemini_enterprise_user_activity" OR
logName="projects/[PROJECT_ID]/logs/discoveryengine.googleapis.com%2Fgen_ai.user.message" OR
logName="projects/[PROJECT_ID]/logs/discoveryengine.googleapis.com%2Fgen_ai.choice"

Governance Pipeline (Audit Logs)

Captures admin actions and data plane operations. Inclusion filter:

logName:"projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com" AND 
protoPayload.serviceName="discoveryengine.googleapis.com"

Admin Activity logs are always enabled; Data Access logs must be enabled in IAM for the Discovery Engine API.

Unlock Advanced Intelligence in BigQuery

No-Code Conversational Analytics

BigQuery’s Conversational Analytics (BQ CA) lets you ask questions in plain English. For example, “Compare the usage of notebooklm, deep research and custom agents using oob_metrics?” generates the correct SQL and runs it in seconds. It even shows its thinking process.

Auto-Generated Schema Documentation

Understanding fields like useriamprincipal or finish_reason is crucial. BigQuery’s Data Insights automatically profiles tables, generates descriptions, and maps relationships. This enriched metadata feeds into BQ CA, making queries more accurate.

Visualize with Data Studio

Connect Data Studio to BigQuery to build executive dashboards tracking adoption, grounding traffic, safety violations, and more. You can even share your BQ CA agents with business users.

Get Started

1. Deploy the Gemini Enterprise App
2. Enable Prompt & Response Logging
3. Configure Log Router Sinks
4. Track Metrics & Export Analytics
5. Extract Table-Level & Dataset-Level Insights
6. Query with Conversational Analytics
7. Visualize with Data Studio
8. Consult a Google Cloud Customer Engineer for cost-effective configuration.

With BigQuery, you’re not just swimming in logs—you’re navigating the swamp with a clear map. Happy governing!

Original announcement published on Google Cloud.