Enable Model Armor in Gemini Notebook Enterprise Stay organized with collections Save and categorize content based on your preferences.

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This document describes how to enable Model Armor for Gemini Notebook Enterprise. Model Armor is a Google Cloud service that enhances the security and safety of your AI applications by proactively screening the prompts and responses given using Gemini Notebook Enterprise. This helps protect against various risks and ensures responsible AI practices. Model Armor is supported on Gemini Notebook Enterprise at no additional cost.

Model Armor's response to potential issues in user queries or responses from Gemini Notebook Enterprise is governed by the template's enforcement type.

• If the enforcement type is Inspect and block, Gemini Notebook Enterprise blocks the request and displays an error message. This is the default enforcement type when you create a Model Armor template using the console.

• If the enforcement type is Inspect only, Gemini Notebook Enterprise does not block the requests or responses.

For more information, see Define the enforcement type.

Before you begin

Make sure you have the required roles assigned to you and the service account:

• To enable Model Armor in Gemini Notebook Enterprise, you need the Gemini Enterprise Admin (roles/discoveryengine.agentspaceAdmin) role.

• To create the Model Armor templates, you need the Model Armor Admin role (roles/modelarmor.admin).

• To call the Model Armor APIs, you need the Model Armor User role (roles/modelarmor.user).

• If your Model Armor template is in a different project than your notebook in Gemini Notebook Enterprise, the template's project must grant the Model Armor User role (roles/modelarmor.user) to the notebook's service account. The service account ID is service-PROJECT_NUMBER@gcp-sa-discoveryengine.iam.gserviceaccount.com, where PROJECT_NUMBER is the project number of your Gemini Notebook Enterprise instance.

Create a Model Armor template

You can create and use the same Model Armor template for user prompts and responses from the assistant, or you can create two separate Model Armor templates. For more information, see Create and manage Model Armor templates.

When creating a Model Armor template for Gemini Notebook Enterprise, consider these configurations:

• You can create Model Armor templates centrally in one project and reuse them across different projects. If you use a cross-project template, ensure that the cross-project permissions are configured as described in Before you begin.

• Select Multi-region in the Regions field. The following table shows you how to map Model Armor template regions to Gemini Notebook Enterprise regions:

  Note: After a Model Armor template and Gemini Notebook Enterprise is created, the regions can't be changed.

  Gemini Notebook Enterprise multi-region	Model Armor multi-region
  Global	US (multiple regions in United States) EU (multiple regions in the Europe Union)
  US (multiple regions in United States)	US (multiple regions in United States)
  EU (multiple regions in the Europe Union)	EU (multiple regions in the Europe Union)

• Google does not recommend configuring Cloud Logging in the Model Armor template for Gemini Notebook Enterprise. This configuration can expose sensitive data to users with the Private Logs Viewer (roles/logging.privateLogViewer) IAM role. Instead, consider the following options:

  • If you need to log the data that goes through the Model Armor template, you can reroute logs to a secure storage like BigQuery, which offers stricter access controls. For more information, see Route logs to supported destinations.

  • You can configure Data Access audit logs to analyze and report on the request and response screening verdicts generated by Model Armor. For more information, see Configure audit logs.

Configure Gemini Notebook Enterprise with the Model Armor templates

The following steps describe how to add the Model Armor templates to Gemini Notebook Enterprise.

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-H "X-Goog-User-Project: PROJECT_ID" \
"https://ENDPOINT_LOCATION-discoveryengine.googleapis.com/v1alpha/projects/PROJECT_NUMBER?update_mask=customerProvidedConfig" \
-d '{
  "customerProvidedConfig": {
    "notebooklmConfig": {
      "modelArmorConfig": {
        "userPromptTemplate": "QUERY_PROMPT_TEMPLATE",
        "responseTemplate": "RESPONSE_PROMPT_TEMPLATE"
      }
    }
  }
}'

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-H "X-Goog-User-Project: my-project-123" \
"https://discoveryengine.googleapis.com/v1/projects/123456?update_mask=customerProvidedConfig" \
-d '{
  "customerProvidedConfig": {
    "notebooklmConfig": {
      "modelArmorConfig": {
        "userPromptTemplate": "projects/my-project-123/locations/us/templates/model-armor-template",
        "responseTemplate": "projects/my-project-123/locations/us/templates/model-armor-template"
      }
    }
  }
}'

{
  "name": "projects/123456",
  "createTime": "2025-04-18T19:38:23.299346527Z",
  "provisionCompletionTime": "2025-04-18T19:38:23.299346527Z",
  "customerProvidedConfig": {
    "notebooklmConfig": {
      "modelArmorConfig": {
        "userPromptTemplate": "projects/my-project-123/locations/us/templates/model-armor-template",
        "responseTemplate": "projects/my-project-123/locations/us/templates/model-armor-template"
      }
    }
  }
}

Test if the Model Armor template is enabled

After configuring the Model Armor template, test if Gemini Notebook Enterprise proactively screens and blocks user prompts and responses according to the confidence levels set in the Model Armor filters.

When the Model Armor template is configured to Inspect and block requests that violate the policy, the following policy violation message is shown:

Remove the Model Armor templates from Gemini Notebook Enterprise

To remove the Model Armor templates from Gemini Notebook Enterprise, run the following command:

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-H "X-Goog-User-Project: PROJECT_ID" \
"https://ENDPOINT_LOCATION-discoveryengine.googleapis.com/v1alpha/projects/PROJECT_NUMBER?update_mask=customerProvidedConfig" \
-d '{
  "customerProvidedConfig": {
    "notebooklmConfig": {
      "modelArmorConfig": {}
    }
  }
}'

curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-H "X-Goog-User-Project: my-project-123" \
"https://discoveryengine.googleapis.com/v1/projects/123456?update_mask=customerProvidedConfig" \
-d '{
  "customerProvidedConfig": {
    "notebooklmConfig": {
    }
  }
}'

{
  "name": "projects/123456",
  "createTime": "2025-04-18T19:38:23.299346527Z",
  "provisionCompletionTime": "2025-04-18T19:38:23.299346527Z",
  "customerProvidedConfig": {
    "notebooklmConfig": {}
  }
}

Configure audit logs

Model Armor records Data Access audit logs that you can use to analyze the request and response screening verdicts. These logs don't contain the user queries or responses from Gemini Notebook Enterprise, so they are safe for reporting and analytics. For more information, see Audit logging for Model Armor.

To access these logs, you need to have the Private Logs Viewer (roles/logging.privateLogViewer) IAM role.

Enable Data Access audit logs

To enable the Data Access audit logs, follow these steps:

1. In the Google Cloud console, go to IAM & Admin > Audit Logs.

2. Select the Model Armor API.

3. In the Permission type section, select the Data read permission type.

4. Click Save.

Examine Data Access audit logs

To examine the Data Access audit logs, follow these steps:

1. In the Google Cloud console, go to Logs Explorer.

2. Search the logs for the following method names:

   • google.cloud.modelarmor.v1.ModelArmor.SanitizeUserPrompt to view the user requests that were screened.

   • google.cloud.modelarmor.v1.ModelArmor.SanitizeModelResponse to view the responses that were screened.