Apigee X VPC Service Controls: Best Practices for Secure API Traffic in 2026
Master Apigee X VPC Service Controls for secure API traffic in South Africa. Learn best practices for deployment, network topology, and compliance.
Read6 min
Google Cloud partner
Google Cloud partner practice — data platforms, Gemini and agents.
Google Cloud is a core platform in our data engineering and AI work. We build warehouses and lakehouses on BigQuery, run document intelligence and fraud scoring with Gemini, and build governed agents on the Gemini Enterprise Agent Platform — with the Johannesburg region keeping South African data in the country.
Why Google Cloud, and what changed in 2026
Google Cloud is the data-first cloud, and BigQuery is the reason. It is serverless in a way its competitors still are not — no clusters to size, no warehouses to suspend, separation of storage and compute that genuinely behaves that way under load. For teams whose problem is analytical scale rather than platform engineering, that removes an entire category of work. The AI layer sits directly on top of the same data, which is why our document intelligence and fraud work keeps landing here.
For South African organisations the location question has a clean answer. Google Cloud opened its Johannesburg region in January 2024 — the company's first cloud region on the African continent — with three zones and connectivity through the Equiano subsea cable system. For workloads with a stricter obligation, Assured Workloads offers a South Africa Data Boundary control package that pins data location to South African regions rather than relying on configuration discipline. That combination is a genuinely strong POPIA story, and we still document it explicitly with your information officer rather than assuming the defaults are right.
The thing most teams have not caught up with is the April 2026 reorganisation. On 22 April 2026, at Cloud Next, Google launched the Gemini Enterprise Agent Platform as the evolution of Vertex AI — and stated that all Vertex AI services and roadmap evolutions would from then on be delivered exclusively through the Agent Platform rather than as a standalone service. In practice your existing workloads keep running and the skills transfer, but the documentation, the console and the roadmap have moved. If your team is still searching for Vertex AI tutorials, that is why the answers feel a year out of date.
We have built production systems on this stack, not just proofs of concept: a FICA compliance and fraud platform for a South African neo bank using Gemini for KYC document verification and a low-latency endpoint for real-time transaction scoring, and a full BigQuery data estate for a neo bank with a medallion architecture, dbt lineage and automated regulatory reporting. We are also an independent member of Anthropic's Claude Partner Network, and Model Garden carries Anthropic's Claude models alongside Google's own — so model choice stays an engineering decision rather than a vendor one.
What we build with Google Cloud
BigQuery data platforms
Serverless warehouses and lakehouses on BigQuery with a medallion layout, partitioning and clustering designed for your query patterns, and governed access through IAM and column-level policies.
Ingestion & streaming
Event streaming with Pub/Sub, stream and batch processing in Dataflow, and orchestration in Cloud Composer — the pattern behind minutes-old analytics rather than yesterday's extract.
dbt, Dataform & semantic modelling
Transformation managed in dbt or Dataform with full lineage and testing, so every downstream dashboard, export and agent works from the same tested definitions.
Gemini & document intelligence
Extraction, classification and verification over KYC packs, claims and invoices with Gemini, with confident cases automated and uncertain ones routed to a human with a structured risk summary.
Agents on the Agent Platform
Agents built in Agent Studio or the Agent Development Kit, deployed on Agent Runtime with Memory Bank for long-term context, and governed through Agent Identity, Agent Registry and Agent Gateway.
Looker, reporting & FinOps
Looker and Looker Studio on a governed model, plus slot reservations, partition strategy and query cost review so BigQuery spend stays proportional to the value it produces.
AI on Google Cloud
What Google Cloud is doing with AI
Google reorganised its entire AI developer surface in April 2026. Here is the stack as it stands in September 2026, including what the rename actually means for teams with existing Vertex AI workloads.
Gemini Enterprise Agent Platform
Launched 22 April 2026 — the evolution of Vertex AIThe platform for building, scaling, governing and optimising agents. It absorbs the model selection, model building and agent building capabilities of Vertex AI and adds agent integration, DevOps, orchestration and security. Google has stated that all Vertex AI services and roadmap evolutions are now delivered exclusively through the Agent Platform rather than as a standalone service.
Model Garden
200+ modelsFirst-class access to more than 200 models: Google's own Gemini 3.1 Pro, Gemini 3.1 Flash Image, Lyria 3 and the open Gemma 4 family, alongside third-party models including Anthropic's Claude Opus, Sonnet and Haiku. Model choice per workload is a cost and quality lever, not a platform commitment.
Agent Studio & the Agent Development Kit
Low-code and code-firstAgent Studio is the visual, low-code path; the Agent Development Kit is the code-first one, now organising agents into a graph-based network of sub-agents so multi-agent logic is explicit rather than emergent. You can prototype in Agent Studio and export to ADK when you need real control. Agent Garden supplies pre-built templates for invoice processing, financial analysis and code modernisation.
Agent Runtime & Memory Bank
Production execution layerAgent Runtime delivers sub-second cold starts and supports long-running agents that hold state autonomously for days — the difference between a chatbot and something that manages a multi-step process. Memory Bank curates long-term memory from conversations, and Agent Sessions map interactions to your own CRM or database record IDs.
Agent Identity, Registry & Gateway
Governance layerEvery agent gets a unique cryptographic identity, producing an auditable trail for every action it takes. Agent Registry indexes every approved internal agent, tool and skill; Agent Gateway is the control point between agents and tools, enforcing consistent policy and applying Model Armor protections against prompt injection and data leakage.
Agent security & anomaly detection
Via Security Command CenterAgent Anomaly Detection flags unusual reasoning using statistical models and an LLM-as-a-judge framework, while Agent Threat Detection surfaces malicious activity such as reverse shells or connections to known bad addresses. The Agent Security dashboard maps relationships between agents and models and scans for vulnerabilities underneath.
Agent Simulation, Evaluation & Observability
Quality toolingAgent Simulation tests agents against synthetic users and virtualised tools before release, scoring task success and safety across multi-step conversations. Agent Evaluation scores live traffic with multi-turn autoraters, Agent Observability traces reasoning, and Agent Optimizer clusters real failures and proposes better instructions.
Agent Sandbox & Workspaces
Secure executionHardened, sandboxed environments where an agent can execute model-generated code, run shell commands, manage files and perform browser automation without touching your core systems — the safe way to let an agent act rather than only advise.
Data Science & Data Engineering agents
Built into the data stackThe Data Science Agent executes plans for loading, cleaning and visualising data in BigQuery notebooks from a plain-English goal. The Data Engineering Agent builds Dataform pipelines autonomously while enforcing governance rules and tests. Batch and event-driven agents activate data directly from BigQuery and Pub/Sub.
Gemini Enterprise & Deep Research
The employee-facing front doorAgents built on the Agent Platform are delivered to staff through the Gemini Enterprise app. The Gemini Deep Research Agent, in preview, plans and executes multi-step research across both the public web and private enterprise data, returning cited reports rather than unattributed prose.
How South African teams use Google Cloud with us
01
KYC and FICA document automation
Gemini extracting, classifying and verifying identity and proof-of-address documents, routing confident cases to automated approval and sending uncertain ones to a reviewer with a structured risk summary rather than a raw scan.
02
Real-time fraud and transaction scoring
Low-latency model endpoints scoring every transaction against an ensemble trained on historical fraud, tuned to cut the false positives that quietly erode customer experience in a rules-only system.
03
Regulatory reporting on BigQuery
A medallion architecture with quality enforced at each layer, dbt lineage and tested gold tables, so regulatory submissions are generated rather than assembled — and any number can be traced back to its source event.
04
Event-driven operational analytics
Pub/Sub and Dataflow moving transactions into BigQuery within minutes, giving risk, operations and commercial teams something current enough to act on.
05
Internal agents over company knowledge
Agents built in ADK and deployed on Agent Runtime, grounded in your documents and BigQuery data, delivered through Gemini Enterprise and governed with Agent Identity and Model Armor so prompt injection is a handled case rather than a headline.
06
Migrating off a legacy warehouse
On-premise or legacy cloud warehouses moved to BigQuery with automated reconciliation against the old reports, plus slot reservations and partition design so the new platform is cheaper rather than merely newer.
From our Google Cloud practice
What we're building on Google Cloud.
What we're building, testing and shipping on Google Cloud — written up as we go.
Google Cloud questions we get asked
- Can our data stay in South Africa on Google Cloud?
- Yes, and this is one of Google Cloud's stronger positions locally. The Johannesburg region opened in January 2024 as Google Cloud's first region on the African continent, with three zones, so data and compute can stay in-country for POPIA and the National Policy on Data and Cloud. For stricter obligations, Assured Workloads provides a South Africa Data Boundary control package that enforces data location to South African regions rather than leaving it to configuration discipline. Not every service is available in every region, so we verify the specific services your workload needs and document the result before anything moves.
- What happened to Vertex AI — is it discontinued?
- It is not discontinued; it has been absorbed. On 22 April 2026 Google launched the Gemini Enterprise Agent Platform as the evolution of Vertex AI, combining its model selection, model building and agent building capabilities with new agent integration, orchestration, DevOps and security features. Google stated that all Vertex AI services and roadmap evolutions would from then on be delivered exclusively through the Agent Platform rather than as a standalone service. Existing workloads keep running and the skills transfer directly, but the console, documentation and roadmap have moved — which is why older tutorials feel stale.
- Should we use BigQuery, Snowflake or Databricks?
- It depends on where your team and your workloads already are, and we will say so if Google Cloud is not the right fit. BigQuery suits teams that want genuinely serverless analytics with no cluster management and AI sitting on the same data. Snowflake suits strong governance, data sharing and business-user AI across clouds. Databricks suits heavy Spark, streaming and machine-learning engineering. We build on all three, which is why the free AI assessment starts with your constraints rather than our preferences.
- Can we use Claude models on Google Cloud?
- Yes. Model Garden provides access to more than 200 models, including Anthropic's Claude Opus, Sonnet and Haiku alongside Google's own Gemini 3.1 and open Gemma 4 families. That means you can ground an agent in BigQuery data and still choose the model that performs best for the task. As an independent member of Anthropic's Claude Partner Network we tend to use Claude for reasoning-heavy agent work and Gemini where its multimodal document handling and price point win — and we will show you the evaluation rather than assert a preference.
- How do we govern agents so they do not become a security problem?
- Use the platform's own controls rather than inventing your own. Every agent receives a unique cryptographic identity that produces an auditable trail of its actions; Agent Registry keeps a single approved inventory; Agent Gateway sits between agents and tools enforcing policy and applying Model Armor against prompt injection and data leakage; and Agent Sandbox contains any code execution or browser automation. Agent Anomaly Detection and Agent Threat Detection then watch for unusual reasoning and malicious activity in production. We configure these at the start of a build, because retrofitting governance onto a fleet of agents is considerably more expensive than designing it in.
- How is BigQuery priced, and how do we avoid a surprise?
- BigQuery bills separately for storage and for query compute, either on-demand by bytes scanned or through slot reservations for predictable workloads. The surprises almost always come from query design rather than pricing: unpartitioned tables, SELECT star over wide tables, and dashboards that refresh far more often than anyone reads them. We set partitioning and clustering deliberately, review the most expensive queries, and move steady workloads onto reservations as part of every engagement.
- Are you an official Google Cloud partner?
- We describe ourselves as a Google Cloud partner practice: that phrase describes our delivery capability across BigQuery, Gemini and the Agent Platform, not a signed programme membership, and Automation Architects is independent of Google LLC and not affiliated with, sponsored by or endorsed by it. Our only formal programme membership is Anthropic's Claude Partner Network. We would rather be precise about that than let a badge do the talking.
Let's build it on Google Cloud
Tell us what you're trying to achieve and we'll map the right approach on Google Cloud — no obligation.
Book a free AI assessmentGoogle Cloud and the Google Cloud logo are trademarks of Google LLC. Automation Architects is an independent consultancy and is not affiliated with, sponsored by, or endorsed by Google LLC. References to Google Cloud describe the technologies we implement and do not imply certification of any specific outcome.