I would build the GCP version around the same financial-services use case as the AWS architecture, but use the current 2026 Google Cloud stack: Gemini Enterprise Agent Platform, ADK, Agent Runtime, Model Garden, Model Armor, GKE, BigQuery Vector Search, Cloud Storage, VPC Service Controls, IAM, Cloud KMS, Cloud Logging/Monitoring, and MCP/A2A where appropriate.
Google's current Agent Platform has evolved from the older Vertex AI-centric terminology and now provides model access, agent development, evaluation, deployment, orchestration and governance. ADK can run agents on Agent Runtime, Cloud Run or GKE. (Google Cloud)
GCP Enterprise GenAI + Agentic AI Architecture
1. The business problem
Let's use the same banking scenario:
"Investigate why counterparty ABC breached its exposure limit yesterday and tell me what action should be taken."
The system needs to combine:
Unstructured knowledge
│
├── Risk policies
├── Regulatory documents
├── Credit policies
└── Internal procedures
Structured data
│
├── Counterparty exposure
├── Credit limits
├── Trades
├── P&L
└── Risk metrics
Enterprise tools
│
├── Risk APIs
├── Trade APIs
├── SQL
└── Workflow systemsThis is therefore not merely a chatbot.
It is:
RAG + Agent + Enterprise Data + Enterprise Tools2. Complete GCP architecture
USERS
│
▼
┌─────────────────────┐
│ Cloud Load Balancer │
└──────────┬──────────┘
│
Cloud Armor
WAF + DDoS Defense
│
▼
┌─────────────────────┐
│ API / Ingress Layer │
└──────────┬──────────┘
│
PRIVATE NETWORK
│
┌────────────────┴────────────────┐
│ │
▼ ▼
┌───────────────┐ ┌───────────────┐
│ GKE │ │ Cloud Run │
│ │ │ │
│ APIs │ │ Lightweight │
│ UI │ │ services │
│ AI Gateway │ │ Agent APIs │
└───────┬───────┘ └───────┬───────┘
│ │
└────────────────┬────────────────┘
▼
┌───────────────────────────────┐
│ Gemini Enterprise │
│ Agent Platform │
│ │
│ Agent Runtime │
│ ADK │
│ Agent Studio │
│ Model Garden │
└───────────────┬───────────────┘
│
┌──────────────────┼───────────────────┐
│ │ │
▼ ▼ ▼
Model Armor RAG Layer Tool Layer
│ │ │
▼ ▼ ▼
Gemini BigQuery Vector Enterprise APIs
Claude Search MCP
Gemma Cloud Storage SQL
│ │ A2A
│ │
│ ┌────┴─────┐
│ ▼ ▼
│ BigQuery Cloud Storage
│ tables documents
│
└──────────────────────┐
▼
Cloud Monitoring
Cloud Logging
Cloud TraceThis architecture is consistent with Google's current direction: ADK supports agent development, evaluation and deployment, and agents can be deployed to Agent Runtime, Cloud Run or GKE. (Google Cloud Documentation)
3. Perimeter and ingress
The first layer is:
Internet
│
▼
Cloud Load Balancing
│
▼
Cloud Armor
│
├── WAF
├── DDoS protection
├── IP rules
├── Rate controls
└── Threat filtering
│
▼
GKE / Cloud RunI would make Cloud Armor the first major security control rather than allowing the application itself to deal with malicious traffic.
Example:
Attacker
│
▼
Cloud Load Balancer
│
▼
Cloud Armor
│
├── BLOCK ──► malicious request
│
└── ALLOW
│
▼
GKE4. Why GKE?
For this particular architecture, GKE makes sense because we have:
Multiple microservices
+
Agent orchestration
+
High concurrency
+
Custom networking
+
MCP services
+
Tool services
+
Potential GPU workloads
+
Fine-grained scalingA possible GKE cluster:
GKE CLUSTER
│
├── ingress-service
│
├── frontend-service
│
├── api-service
│
├── ai-gateway
│
├── rag-service
│
├── agent-service
│
├── tool-service
│
├── mcp-server
│
└── background-workersBut I would not automatically put everything into GKE.
A senior architect answer is:
"I use GKE when Kubernetes control, workload diversity, networking or GPU scheduling justifies it. For lightweight stateless APIs or simple agents, Cloud Run can reduce operational overhead."
Google's own current architecture supports ADK agents on GKE, Cloud Run and Agent Runtime. (Google Cloud Documentation)
5. AI Gateway
Don't let every microservice call Gemini directly.
Bad:
Service A ──► Gemini
Service B ──► Gemini
Service C ──► Gemini
Service D ──► GeminiInstead:
Applications
│
▼
AI Gateway
│
┌──────────────┼──────────────┐
│ │ │
Security Routing Cost
│ │ │
▼ ▼ ▼
IAM Model selection Token tracking
│ │ │
└──────────────┼──────────────┘
▼
Agent Platform
│
┌──────┼──────┐
▼ ▼ ▼
Gemini Claude GemmaThe gateway can implement:
Authentication
Authorization
Tenant isolation
Rate limiting
Model routing
Prompt policies
Cost tracking
Token budgets
Observability
Circuit breakers6. Gemini Enterprise Agent Platform
The current Google architecture gives you a managed platform for the agent lifecycle.
Conceptually:
Agent Platform
│
┌───────────────┼────────────────┐
│ │ │
▼ ▼ ▼
Model Garden Agent Studio Agent Runtime
│ │ │
▼ ▼ ▼
Models Build agents Deploy agentsModel Garden provides access to Google's models and third-party models. Google describes Agent Platform as the evolution of Vertex AI for building, scaling, governing and optimizing agents. (Google Cloud)
For code-first development, I would use ADK.
7. ADK
ADK becomes the programming framework for our agent.
Very simplified:
from google.adk.agents import Agent
root_agent = Agent(
name="risk_investigation_agent",
model="gemini-3.5-flash",
instruction="""
You are a financial risk investigation agent.
Investigate counterparty exposure breaches.
Never execute financial actions without
human approval.
Always provide evidence for conclusions.
""",
tools=[
get_counterparty_exposure,
get_counterparty_limit,
get_recent_trades,
search_risk_policy
]
)The exact model/version should be selected from the currently available models in the target region/project rather than hard-coding an interview answer around a particular model.
ADK currently supports Python, TypeScript, Go and Java and supports multi-agent architectures and tool integrations. (Google Cloud Documentation)
8. Model Garden
Model Garden is your model abstraction layer.
Model Garden
│
┌──────────────┼──────────────┐
▼ ▼ ▼
Gemini Third-party Open
models models
│ │ │
└──────────────┼──────────────┘
▼
Agent PlatformThe architectural benefit is model optionality.
For example:
High reasoning requirement
↓
larger Gemini model
High-volume classification
↓
smaller/faster model
Specialized workload
↓
third-party modelGoogle currently describes Model Garden as providing access to 200+ models. (Google Cloud)
9. RAG architecture
Now let's build the RAG component.
Suppose we have:
Cloud Storage
│
├── credit_policy.pdf
├── counterparty_policy.pdf
├── market_risk_policy.pdf
├── Basel_rules.pdf
└── escalation_procedure.pdfPipeline:
Cloud Storage
│
▼
Document pipeline
│
┌────────┼────────┐
▼ ▼ ▼
Parse Chunk Metadata
│ │ │
└────────┼────────┘
▼
Embedding
│
▼
BigQuery Vector
│
▼
Vector SearchBigQuery is particularly attractive here because the same platform can hold structured financial data and support vector search.
10. Why BigQuery is powerful for this architecture
This is one of the strongest differences from the AWS example.
AWS:
OpenSearch
+
Aurora
+
S3GCP can consolidate more of this:
BigQuery
│
┌───────────┴───────────┐
│ │
Structured data Vector data
│ │
exposures embeddings
trades documents
limits chunks
P&L metadataNow the agent can combine:
SQL analytics
+
Vector retrievalwithin the same analytical environment.
11. Example BigQuery data model
Structured table:
counterparty_exposure
────────────────────────────
counterparty_id
exposure
currency
timestamp
desk
regionLimits:
counterparty_limits
────────────────────
counterparty_id
approved_limit
currency
rating
effective_dateDocument chunks:
risk_policy_chunks
────────────────────────
document_id
chunk_id
content
embedding
tenant_id
classification
policy_type
effective_date12. Vector retrieval
Conceptually:
SELECT
document_id,
chunk_id,
content,
distance
FROM VECTOR_SEARCH(
TABLE `risk.risk_policy_chunks`,
'embedding',
(
SELECT embedding
FROM `risk.query_embedding`
),
top_k => 5
)
ORDER BY distance;In production you would also apply authorization and business metadata filters.
For example:
tenant_id
region
classification
business_unit
effective_date13. Authorization-aware RAG
This is critical.
Never:
User
↓
Vector Search
↓
All documentsInstead:
User
│
▼
IAM
│
▼
Identity context
│
├── tenant
├── role
├── region
└── classification
│
▼
Vector Search
│
▼
Authorized documents onlyFor example:
filters = {
"tenant_id": user.tenant_id,
"region": user.region,
"classification": {
"$in": user.allowed_classifications
}
}The exact filtering implementation depends on the chosen BigQuery/vector architecture, but the security principle is essential:
Retrieval authorization must happen before information reaches the LLM.
14. RAG request flow
User:
"What happens when a counterparty falls below investment grade?"
Flow:
USER
│
▼
Cloud Armor
│
▼
GKE API
│
▼
AI Gateway
│
▼
Model Armor
│
▼
Query embedding
│
▼
BigQuery Vector Search
│
▼
Top-K authorized chunks
│
▼
Prompt construction
│
▼
Gemini
│
▼
Model Armor
│
▼
Answer + citations15. Model Armor
Model Armor belongs around the model interaction rather than being treated as a replacement for application security.
USER
│
▼
Model Armor
INPUT CHECK
│
▼
Agent / RAG
│
▼
Gemini
│
▼
Model Armor
OUTPUT CHECK
│
▼
USERIt can be used to address AI-specific threats such as prompt injection and sensitive information leakage. Google has also documented Model Armor protecting AI inference running on GKE. (Google Cloud)
But don't claim:
"Model Armor guarantees no hallucinations."
Instead:
Hallucination control
=
RAG grounding
+
tool constraints
+
structured outputs
+
evaluation
+
citations
+
business validation
+
Model Armor16. Agentic AI architecture
Now we extend RAG.
USER
│
▼
Risk Agent
│
┌───────┴────────┐
│ Planner │
└───────┬────────┘
│
┌───────────────────┼────────────────────┐
│ │ │
▼ ▼ ▼
RAG Agent Exposure Tool Trade Tool
│ │ │
▼ ▼ ▼
BigQuery Vector BigQuery/API Trade System
│ │ │
└───────────────────┼────────────────────┘
▼
Reasoning Agent
│
▼
Risk Assessment
│
▼
Human Approval17. The agent's tools
We define deterministic tools.
async def get_exposure(counterparty_id: str):
...
async def get_limit(counterparty_id: str):
...
async def get_recent_trades(
counterparty_id: str,
hours: int
):
...
async def search_risk_policy(
question: str
):
...
async def calculate_breach(
exposure: float,
limit: float
):
...The LLM doesn't get unrestricted database access.
It gets controlled capabilities.
18. Example investigation
User:
"Investigate ABC's exposure breach."
Agent workflow:
User
│
▼
Risk Agent
│
▼
get_exposure("ABC")
│
▼
$125M
│
▼
get_limit("ABC")
│
▼
$100M
│
▼
calculate_breach()
│
▼
$25M breach
│
▼
get_recent_trades("ABC")
│
▼
Trade information
│
▼
search_risk_policy()
│
▼
Policy evidence
│
▼
Risk conclusion19. BigQuery becomes extremely powerful here
Imagine:
SELECT
counterparty_id,
SUM(exposure) AS exposure
FROM
`risk.trades`
WHERE
counterparty_id = 'ABC'
AND trade_date >= CURRENT_DATE() - 1
GROUP BY
counterparty_id;Agent gets:
ABC
Exposure = $125MThen:
SELECT
approved_limit
FROM
`risk.counterparty_limits`
WHERE
counterparty_id = 'ABC'
ORDER BY effective_date DESC
LIMIT 1;Returns:
Limit = $100MThen the agent can combine this with RAG:
Structured evidence
+
Policy evidence
+
Trade evidence
↓
Agent reasoningThis is what makes the architecture genuinely useful for financial engineering.
20. RAG + SQL + Tools
Think of the agent as having three knowledge mechanisms:
AGENT
│
┌──────────────────┼──────────────────┐
│ │ │
▼ ▼ ▼
RAG SQL API
│ │ │
▼ ▼ ▼
Documents Financial data Enterprise systemsRAG answers:
"What does the policy say?"
SQL answers:
"What actually happened?"
API/tool answers:
"What does the enterprise system currently report?"
Agent combines all three.
21. MCP
For a modern GCP architecture, I would also introduce MCP.
Agent
│
▼
MCP Client
│
┌───────────┼────────────┐
▼ ▼ ▼
Risk MCP Trade MCP Policy MCP
│ │ │
▼ ▼ ▼
Risk API Trade API BigQueryThis creates a standardized tool interface.
Google's current agent architecture documentation explicitly discusses MCP, and Google's Agent Registry can authenticate agents to remote agents or MCP toolsets. (Google Cloud Documentation)
22. Multi-agent architecture
For a more advanced interview answer:
Supervisor Agent
│
┌───────────────────┼──────────────────┐
▼ ▼ ▼
Risk Agent Compliance Agent Trade Agent
│ │ │
▼ ▼ ▼
Risk Data Policies Trade Data
│ │ │
└───────────────────┼──────────────────┘
▼
Decision Agent
│
▼
Human ApprovalADK supports multi-agent architectures where specialized agents can collaborate and delegate tasks. (Google Cloud Documentation)
But don't introduce multi-agent architecture just because it sounds sophisticated.
My interview answer would be:
"I start with a single agent and deterministic tools. I introduce multiple agents only when separation of responsibility, independent evaluation, security boundaries or organizational ownership justify the additional orchestration complexity."
That is a much stronger architect answer.
23. Human-in-the-loop
For financial services:
Agent
│
▼
Recommendation
│
▼
Risk Officer
│
├──── APPROVE
│ │
│ ▼
│ Execute action
│
└──── REJECT
│
▼
StopExample:
Agent:
ABC exceeds its approved limit by $25M.
Evidence:
- Exposure: $125M
- Limit: $100M
- Policy: Section 4.3
- Primary driver: Trade XYZ
Recommendation:
Escalate to Risk Control.The agent should not automatically change the credit limit.
24. Security architecture
Now the most important enterprise part.
INTERNET
│
▼
Cloud Load Balancer
│
▼
Cloud Armor
│
▼
GKE
│
┌────────┴────────┐
│ │
▼ ▼
IAM Service Accounts
│ │
└────────┬────────┘
▼
VPC Service
Controls
│
┌─────────────┼─────────────┐
▼ ▼ ▼
BigQuery Cloud Storage Agent Platform25. IAM
Use separate service identities.
User
│
▼
Identity
│
▼
IAM
│
├── Analyst
├── Risk Manager
├── Admin
└── Agent Service AccountDon't give the agent:
roles/ownerInstead:
Agent Service Account
├── Read risk tables
├── Read approved documents
├── Execute selected APIs
└── No unrestricted write access26. VPC Service Controls
This is one of the strongest GCP security controls for this architecture.
Conceptually:
SECURITY PERIMETER
┌───────────────────────────┐
│ │
│ Financial Data │
│ │
│ BigQuery │
│ Cloud Storage │
│ AI services │
│ │
└───────────────────────────┘
│
VPC Service
Controls
│
Data exfiltration
preventionEven if an identity is compromised, VPC-SC provides a network-level/data-perimeter control.
Google specifically recommends VPC Service Controls as a key perimeter guardrail for agentic AI workloads and has added newer capabilities aimed at agentic workloads. (Google Cloud)
Current Agent Platform security controls include VPC Service Controls, CMEK and Access Transparency, subject to service-specific support. (Google Cloud Documentation)
27. Cloud KMS
For highly regulated environments:
Data
│
▼
Cloud KMS
│
▼
Customer-managed encryption key
│
├── BigQuery
├── Cloud Storage
└── Other supported servicesUse CMEK where the service and compliance requirements justify it.
28. Complete secure network architecture
INTERNET
│
▼
┌─────────────────────┐
│ Cloud Load Balancer │
└──────────┬──────────┘
│
Cloud Armor
WAF + DDoS
│
▼
PRIVATE GKE
│
┌────────────┼────────────┐
│ │ │
▼ ▼ ▼
API Layer AI Gateway Agent Layer
│ │ │
└────────────┼────────────┘
│
VPC Service Controls
│
┌─────────────┼─────────────┐
│ │ │
▼ ▼ ▼
BigQuery Cloud Storage Agent Platform
│ │ │
▼ ▼ ▼
Vector DB Documents Gemini29. Observability
For production, instrument everything.
Application
│
┌────────────┼────────────┐
▼ ▼ ▼
Metrics Logs Traces
│ │ │
└────────────┼────────────┘
▼
Cloud Monitoring
Cloud Logging
Cloud Trace
│
▼
DashboardMonitor:
API latency
p50
p95
p99
Agent latency
RAG latency
BigQuery latency
LLM latency
Tokens
Cost
Requests
Errors
Tool failures
Agent retries
Agent loops
Prompt injection
Guardrail blocks
GPU utilization
GPU memory
Queue depthFor agents, trace the entire trajectory:
Request
│
├── Guardrail
│
├── Agent
│
├── RAG
│ └── BigQuery
│
├── Tool
│ └── Risk API
│
├── Tool
│ └── Trade API
│
└── GeminiGoogle's current Agent Platform tooling supports evaluation and observability around agent execution, and Cloud Trace is used in the current Agents CLI deployment workflow. (Google Cloud Documentation)
30. Agent evaluation
This is something I would add to your original architecture because it is important for a senior GenAI interview.
Don't deploy an agent simply because:
"It works."Create an evaluation dataset:
100–1,000 historical questions
│
▼
Agent runs
│
▼
Evaluate
│
┌────────┼────────┐
▼ ▼ ▼
Accuracy Grounding SafetyMeasure:
Answer correctness
Citation correctness
Retrieval precision
Retrieval recall
Groundedness
Tool selection
Tool arguments
Trajectory correctness
Safety
Latency
CostADK and Agent Platform now provide evaluation capabilities for testing agent execution and trajectories. (Google Cloud Documentation)
31. CI/CD architecture
Developer
│
▼
Git
│
▼
Cloud Build
│
├── Unit tests
├── Security scan
├── Agent evaluation
├── RAG evaluation
└── Prompt tests
│
▼
Artifact Registry
│
▼
GKE
│
┌────┴─────┐
▼ ▼
Staging Production
│
▼
Evaluation
│
▼
Approval32. Production scaling
This addresses the architecture problems you asked about earlier.
Don't scale only based on CPU.
For GenAI:
GKE
│
├── CPU
├── Memory
├── Requests
├── Queue depth
├── Agent concurrency
├── RAG latency
└── Model latencyFor GPU workloads:
GPU utilization
GPU memory
tokens/sec
requests/sec
queue depth
KV-cache pressureThen:
Load
│
▼
GKE Autoscaler
│
┌───────┼────────┐
▼ ▼ ▼
Pod 1 Pod 2 Pod 3
│ │ │
└───────┼────────┘
▼
GeminiFor managed Gemini inference, you generally don't manage the underlying GPU concurrency yourself in the same way you would for self-hosted models. If you deploy custom models on GKE, however, GPU capacity, batching, concurrency and memory become your responsibility.
33. Failure architecture
This is another important senior-level topic.
BigQuery temporarily unavailable
Agent
│
▼
BigQuery
│
X
│
▼
Cache / fallback
│
▼
Graceful responseTool API unavailable
Agent
│
▼
Risk API
│
X
│
▼
Retry
│
▼
Circuit breaker
│
▼
Agent explains
"Exposure data unavailable"Gemini unavailable
Agent
│
▼
Primary model
│
X
│
▼
Fallback model
│
▼
ResponseModel routing can therefore become:
Primary
Gemini
│
X
▼
Fallback
Claude / other approved model
│
X
▼
Graceful degradation34. The final production architecture
This is the diagram I would memorize for your GCP interview:
USERS
│
▼
┌──────────────────────┐
│ Cloud Load Balancer │
└──────────┬───────────┘
│
Cloud Armor
WAF + DDoS
│
▼
┌──────────────────────┐
│ GKE PRIVATE CLUSTER │
│ │
│ API │
│ AI Gateway │
│ RAG Service │
│ Agent Service │
│ MCP Services │
└──────────┬───────────┘
│
IAM / Service Accounts
│
VPC SERVICE CONTROLS
│
┌─────────────────┼──────────────────┐
│ │ │
▼ ▼ ▼
Agent Platform BigQuery Cloud Storage
│ │ │
┌─────┼─────┐ │ Documents
│ │ │ │ │
▼ ▼ ▼ ▼ │
Gemini Claude Gemma SQL + Vector │
│ │ Search │
└─────┬─────┘ │ │
│ │ │
└────────┬────────┘ │
▼ │
AGENT │
│ │
┌────────────┼──────────────┐ │
▼ ▼ ▼ │
RAG SQL/API MCP │
│ │ │ │
└────────────┼──────────────┘ │
▼ │
Model Armor │
│ │
▼ │
Human Approval │
│ │
▼ │
USER │
│
┌────────────────────────────────────────┘
│
▼
Cloud Monitoring
Cloud Logging
Cloud Trace
Cloud KMS
IAM Audit Logs35. AWS → GCP mental mapping
For your interviews, memorize this:
| AWS | GCP |
|---|---|
| CloudFront | Cloud CDN / Cloud Load Balancing |
| AWS WAF | Cloud Armor |
| AWS Shield | Cloud Armor / Google Cloud DDoS protection |
| ALB | Cloud Load Balancing |
| ECS | Cloud Run / GKE |
| EKS | GKE |
| Bedrock | Gemini Enterprise Agent Platform / Model Garden |
| Bedrock Guardrails | Model Armor |
| Bedrock Knowledge Bases | Agent Platform RAG capabilities / custom RAG |
| OpenSearch | BigQuery Vector Search / Vertex AI Vector Search |
| Aurora pgvector | AlloyDB / Cloud SQL with pgvector |
| S3 | Cloud Storage |
| IAM | Cloud IAM |
| KMS | Cloud KMS |
| PrivateLink | Private Service Connect / VPC connectivity patterns |
| CloudWatch | Cloud Monitoring + Cloud Logging |
| X-Ray | Cloud Trace |
| EventBridge | Eventarc |
| SQS | Cloud Tasks / Pub/Sub depending on pattern |
| SNS | Pub/Sub |
| Redshift | BigQuery |
| SageMaker | Vertex AI / Agent Platform |
| ECR | Artifact Registry |
| CodeBuild | Cloud Build |
| EKS autoscaling | GKE autoscaling |
One nuance: there isn't always a strict one-to-one mapping; for example, GCP's networking and managed AI services often combine capabilities that are separate AWS products.
