Build a RAG-Grounded Agent on GCP

Deploy an enterprise AI agent grounded in Cloud Storage data using RAG Engine.

Introduction

30 Second Summary

When you ask a company's support chatbot a question, you expect it to answer based on real product information. Not make things up. Behind the scenes, someone had to decide how that AI gets access to trusted data, who controls it, and how much it costs to run.

In this project, you will architect and deploy a RAG-grounded enterprise AI agent on Google Cloud. You will make the same architectural decisions tested on the PCA renewal exam, covering model selection, data grounding, security, and cost optimization.

What You'll Build

You will build a customer support agent for a fictional retail company using Gemini Enterprise Agent Platform, grounded in a product catalog stored in Cloud Storage via RAG Engine.

By the end of this project, you'll have:

  • A Cloud Storage bucket containing a sample product catalog that simulates structured enterprise data.
  • A RAG corpus indexing that data via RAG Engine, with a grounded Gemini agent deployed in Agent Studio.
  • An architectural decision document covering model choice, security posture, and cost analysis mapped to the Well-Architected Framework.
  • Secret Mission: Swap the grounding source to Agent Search and compare retrieval quality and cost tradeoffs between RAG Engine and Agent Search.

Are there any prerequisites?

You need an active GCP account with billing enabled and the gcloud CLI installed. Hands-on experience with the Google Cloud Console is expected. This project costs under $1 with cleanup.

Set Up Your GCP Project for Agent Platform

Before you can build an enterprise AI agent, your GCP project needs the right APIs enabled, permissions configured, and storage provisioned.

In this step, you will prepare the foundational infrastructure that the Gemini Enterprise Agent Platform requires. Every decision here maps directly to PCA renewal exam patterns around security, least-privilege access, and service enablement.

In this step, get ready to:
  • Enable the required APIs for Agent Platform, Cloud Storage, and Discovery Engine.
  • Configure IAM roles for your user and a dedicated service account.
  • Create a Cloud Storage bucket to store your enterprise data.
Enable the required APIs

GCP services are disabled by default. You need to explicitly enable each API your project depends on before you can call it.

  • Open Cloud Shell in the Google Cloud Console by clicking the terminal icon in the top-right toolbar.
  • Enable all three required APIs by running this command:
gcloud services enable aiplatform.googleapis.com storage.googleapis.com discoveryengine.googleapis.com

What does this command do?

This single command enables three APIs on your active project.

  • aiplatform.googleapis.com unlocks the Agent Platform (Agent Studio, RAG Engine).
  • storage.googleapis.com lets you create buckets and manage objects.
  • discoveryengine.googleapis.com enables the Discovery Engine used by Agent Search.
  • Verify the APIs are enabled by running:
gcloud services list --enabled

You should see aiplatform.googleapis.com, storage.googleapis.com, and discoveryengine.googleapis.com in the output list.

APIs not appearing in the list?

Make sure you have the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on your project. If you are the project owner, you already have this permission.

Also confirm you are working in the correct project. Run gcloud config get-value project to check your active project ID.

Help me troubleshoot why my APIs are not enabling

Configure IAM roles and create a service account

The PCA renewal exam heavily tests IAM and the principle of least privilege. You will grant your user account the minimum roles needed to interact with Agent Platform, then create a dedicated service account for the agent workload itself.

  • Grant your user the Agent Platform User role by running this command (replace your GCP project ID and your email address):
gcloud projects add-iam-policy-binding [[PROJECT_ID="your GCP project ID"]] \
  --member="user:[[USER_EMAIL="your email address"]]" \
  --role="roles/aiplatform.user"
  • Grant yourself the Storage Admin role by running:
gcloud projects add-iam-policy-binding [[PROJECT_ID="your GCP project ID"]] \
  --member="user:[[USER_EMAIL="your email address"]]" \
  --role="roles/storage.admin"

Why two separate roles?

The roles/aiplatform.user role lets you create and manage agents in Agent Studio. The roles/storage.admin role lets you create buckets and upload data.

Granting only what you need follows the least-privilege principle. The exam tests whether you can identify the minimum set of roles for a given workload.

  • Create a dedicated service account for the agent workload by running:
gcloud iam service-accounts create agent-workload-sa \
  --display-name="Agent Workload Service Account"

Why a dedicated service account?

A dedicated service account isolates the agent's permissions from your personal account. If the agent only needs to read data, you grant read-only access to this service account rather than sharing your broad admin credentials.

This is a core exam pattern for data governance and compliance. The exam frequently asks how to limit blast radius when a workload is compromised.

  • Verify your IAM configuration by running:
gcloud projects get-iam-policy [[PROJECT_ID="your GCP project ID"]] \
  --flatten="bindings[].members" \
  --filter="bindings.role:roles/aiplatform.user OR bindings.role:roles/storage.admin"

You should see your email listed under both roles/aiplatform.user and roles/storage.admin.

Permission denied when adding IAM bindings?

You need the Owner or IAM Admin role on the project to modify IAM policies. If you created the project, you are the Owner by default.

Help me fix my IAM permissions

Create a Cloud Storage bucket

Your enterprise data (a product catalog) needs a home. Cloud Storage buckets are the standard way to store unstructured data that gen AI services can access.

  • Create a regional bucket in us-central1 with uniform bucket-level access by running:
gcloud storage buckets create gs://[[BUCKET_NAME="your-unique-bucket-name"]] \
  --location=us-central1 \
  --uniform-bucket-level-access

What is uniform bucket-level access?

Uniform bucket-level access disables per-object ACLs (Access Control Lists) and enforces access exclusively through IAM policies. This simplifies security management and is the recommended approach for enterprise workloads.

The us-central1 region is recommended because Agent Platform services have full availability there.

  • Verify the bucket was created by running:
gcloud storage buckets describe gs://[[BUCKET_NAME="your-unique-bucket-name"]]

You should see your bucket's metadata including the us-central1 location and uniform bucket-level access enabled.

Bucket name already taken?

Cloud Storage bucket names are globally unique across all of GCP. Try adding your project ID or initials as a prefix to the name.

Help me choose a unique bucket name

✔️ Awesome, I've got everything!

Great. Double check you have all three APIs enabled, both IAM roles assigned, and your bucket created before moving on.

ⓧ I'd like to double check my setup

Run these three commands to verify your full setup:

# Check APIs are enabled
gcloud services list --enabled | grep -E "aiplatform|storage|discoveryengine"

# Check IAM bindings
gcloud projects get-iam-policy [[PROJECT_ID="your GCP project ID"]] \
  --flatten="bindings[].members" \
  --filter="bindings.role:roles/aiplatform.user OR bindings.role:roles/storage.admin"

# Check bucket exists
gcloud storage buckets describe gs://[[BUCKET_NAME="your-unique-bucket-name"]]

Your GCP project is now fully configured for gen AI workloads. Next up, you will prepare enterprise data and create a RAG corpus to ground your agent in real information.

Prepare Enterprise Data and Create a RAG Corpus

Your GCP project is configured with the right APIs and IAM roles. Now you need something for your agent to actually know about.

In a real enterprise, an AI agent is only as useful as the data it can access. Without grounding data, the agent hallucinates answers. In this step, you will create a product catalog, index it into a RAG corpus, and verify that the engine can retrieve relevant information from it.

In this step, get ready to:
  • Upload a sample product catalog to your Cloud Storage bucket.
  • Create a RAG corpus using the RAG Engine API with the text-embedding-005 embedding model.
  • Verify that the corpus returns relevant product data for a natural language query.
Upload a sample product catalog

Enterprise agents need structured data to ground their responses. You will create a JSON product catalog that simulates the kind of enterprise data the PCA renewal exam expects you to work with.

  • In Cloud Shell, create the product catalog file by running this command:
cat > product_catalog.json << 'EOF'
[
  {"name": "Ultra Running Shoes", "description": "Lightweight trail running shoes with advanced cushioning and waterproof membrane. Ideal for long-distance trail runs.", "price": 189.99, "category": "Footwear"},
  {"name": "Performance Hiking Backpack 45L", "description": "Durable 45-liter hiking backpack with ergonomic frame, rain cover, and multiple compartments for multi-day treks.", "price": 249.99, "category": "Bags"},
  {"name": "Thermal Base Layer Top", "description": "Merino wool blend base layer providing warmth without bulk. Moisture-wicking and odor-resistant for extended wear.", "price": 79.99, "category": "Clothing"},
  {"name": "Carbon Fiber Trekking Poles", "description": "Ultralight carbon fiber trekking poles with cork grips and quick-lock adjustment. Collapses to 36cm for storage.", "price": 159.99, "category": "Accessories"},
  {"name": "Alpine Waterproof Jacket", "description": "3-layer waterproof breathable jacket rated for extreme conditions. Sealed seams and adjustable hood.", "price": 349.99, "category": "Clothing"},
  {"name": "Compact Camping Stove", "description": "Portable gas camping stove with piezo ignition. Boils 1L of water in under 3 minutes. Weighs only 230g.", "price": 59.99, "category": "Camping"},
  {"name": "Insulated Water Bottle 1L", "description": "Double-wall vacuum insulated stainless steel bottle. Keeps drinks cold 24 hours or hot 12 hours.", "price": 34.99, "category": "Accessories"},
  {"name": "GPS Sports Watch Pro", "description": "Multi-sport GPS watch with heart rate monitor, barometric altimeter, and 14-day battery life.", "price": 449.99, "category": "Electronics"},
  {"name": "Down Sleeping Bag -10C", "description": "800-fill goose down sleeping bag rated to -10C. Weighs 1.2kg with compression sack included.", "price": 299.99, "category": "Camping"},
  {"name": "Climbing Harness Elite", "description": "Lightweight sport climbing harness with four gear loops, adjustable leg loops, and breathable padding.", "price": 89.99, "category": "Climbing"},
  {"name": "UV Protection Sunglasses", "description": "Polarized sport sunglasses with 100% UV protection. Impact-resistant polycarbonate lenses with anti-fog coating.", "price": 129.99, "category": "Accessories"},
  {"name": "Lightweight 2-Person Tent", "description": "Freestanding dome tent for 2 people. Setup in under 5 minutes. Full-coverage rainfly and mesh ventilation.", "price": 279.99, "category": "Camping"}
]
EOF

What does this catalog simulate?

This JSON file represents the kind of structured enterprise data you would see in a PCA renewal exam case study. The exam tests whether you can ground an AI agent in real company data rather than relying on the model's general training.

Each product has a name, description, price, and category. The RAG Engine will chunk and embed this content so the agent can retrieve specific product details when answering questions.

  • Upload the catalog to your Cloud Storage bucket by running:
gsutil cp product_catalog.json gs://enterprise-agent-data-bucket/product_catalog.json
  • Verify the file was uploaded by running:
gsutil ls gs://enterprise-agent-data-bucket/

You should see product_catalog.json listed in the output.

Don't see your file listed?

  • Make sure you ran the cat command first to create the file locally before uploading.
  • Check that the bucket name matches exactly: enterprise-agent-data-bucket.
  • Confirm your gcloud session is authenticated and the project is set correctly.

Having trouble uploading?

Create a RAG corpus

A RAG corpus is the index that the RAG Engine uses to store and retrieve your enterprise data. Creating one tells the platform which embedding model to use for vectorizing your documents.

  • Set your project variables in Cloud Shell by running:
export PROJECT_ID=$(gcloud config get-value project)
export LOCATION=us-central1
  • Create the RAG corpus by running this command:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
https://${LOCATION}-aiplatform.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}/ragCorpora \
-d '{
  "display_name": "enterprise-product-catalog"
}'

What does this command do?

  • It calls the RAG Engine API to create a new corpus named enterprise-product-catalog.
  • The API uses the text-embedding-005 embedding model by default (as specified in the RAG Engine quickstart).
  • The response returns a long-running operation. The corpus creation takes a moment to complete.

The response includes an operation name. Wait about 30 seconds for the corpus to be created, then note the numeric RAG_CORPUS_ID from the response (it appears in the name field).

  • List your corpora to confirm it was created and capture the corpus ID by running:
curl -sS -X GET \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
https://${LOCATION}-aiplatform.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}/ragCorpora/
  • Copy the numeric corpus ID from the name field in the response (the number after ragCorpora/) and set it as a variable:
export RAG_CORPUS_ID=[[RAG_CORPUS_ID="your numeric corpus ID from the response"]]

Now import your product catalog into the corpus with chunking configured.

  • Import the product catalog file into the RAG corpus by running:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
https://${LOCATION}-aiplatform.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}/ragCorpora/${RAG_CORPUS_ID}/ragFiles:import \
-d '{
  "import_rag_files_config": {
    "gcs_source": {
      "uris": ["gs://enterprise-agent-data-bucket/product_catalog.json"]
    },
    "rag_file_chunking_config": {
      "chunk_size": 512,
      "chunk_overlap": 100
    },
    "max_embedding_requests_per_min": 1000
  }
}'

What do chunk_size and chunk_overlap do?

The chunk_size of 512 means the engine splits your data into 512-token segments for embedding. The chunk_overlap of 100 means adjacent chunks share 100 tokens of context, so no information is lost at chunk boundaries.

These values balance retrieval precision with cost. Smaller chunks give more precise retrieval but cost more per query. This is exactly the kind of tradeoff the PCA renewal exam tests.

The import is a long-running operation. Wait 1-2 minutes for the embedding and indexing to complete before moving to the next substep.

Seeing a permission error on import?

  • Confirm your user has the roles/storage.admin role on the project (you set this in Step 1).
  • Verify the bucket URI is exactly gs://enterprise-agent-data-bucket/product_catalog.json with no typos.
  • If you see a quota error related to embedding requests, wait a minute and retry. The default max_embedding_requests_per_min of 1000 should be sufficient for this small file.

Why is my RAG file import failing?

Verify the corpus with a retrieval query

Before connecting the corpus to an agent, you should confirm it actually returns relevant results. The retrieveContexts API lets you test retrieval directly.

  • Create a retrieval query request file by running:
cat > request.json << 'EOF'
{
  "vertex_rag_store": {
    "rag_resources": {
      "rag_corpus": "projects/PROJECT_ID_PLACEHOLDER/locations/us-central1/ragCorpora/RAG_CORPUS_ID_PLACEHOLDER"
    }
  },
  "query": {
    "text": "What waterproof jackets do you have?",
    "similarity_top_k": 3
  }
}
EOF
  • Replace the placeholders in the file with your actual values by running:
sed -i "s/PROJECT_ID_PLACEHOLDER/${PROJECT_ID}/g" request.json
sed -i "s/RAG_CORPUS_ID_PLACEHOLDER/${RAG_CORPUS_ID}/g" request.json
  • Run the retrieval query by running:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://${LOCATION}-aiplatform.googleapis.com/v1/projects/${PROJECT_ID}/locations/${LOCATION}:retrieveContexts"

What should I see?

The response should contain a contexts object with retrieved text chunks from your product catalog. You should see content about the Alpine Waterproof Jacket (and possibly other relevant products) returned with their source URIs pointing to your Cloud Storage file.

If the response contains relevant product information, your RAG corpus is working correctly. The agent can now retrieve enterprise-specific data instead of hallucinating answers.

Getting empty results or an error?

  • If you see empty contexts, the import may still be processing. Wait another minute and retry the query.
  • If you see a NOT_FOUND error, double check that RAG_CORPUS_ID is set correctly by running echo $RAG_CORPUS_ID.
  • Make sure the corpus resource path format is projects/PROJECT_ID/locations/us-central1/ragCorpora/RAG_CORPUS_ID with your actual values substituted.

Why is my RAG retrieval query returning empty results?

Why RAG Engine over fine-tuning?

The PCA renewal exam frequently tests when to use RAG versus fine-tuning. RAG is the right choice when your data changes frequently, you need verifiable source attribution, and you want to avoid the cost and time of retraining a model.

With RAG, your enterprise data stays in Cloud Storage and can be updated without touching the model. Fine-tuning bakes knowledge into model weights, making it expensive to update and impossible to trace back to a source document.

Your enterprise data is indexed and retrievable. Next up, you will connect this corpus to a live agent in Agent Studio and see it answer real product questions.

Build and Ground Your Agent in Agent Studio

Your RAG corpus is loaded with enterprise data and ready to answer retrieval queries. Now it's time to connect that knowledge to a conversational agent that customers can actually interact with.

In this step, you'll create an agent in Agent Studio, configure it with a system instruction, select a model, and ground its responses in your RAG corpus. This is where architectural decisions about model selection become real.

In this step, get ready to:
  • Create a new agent in Agent Studio and configure its system instruction.
  • Select Gemini 2.5 Flash as the model and enable RAG Engine grounding.
  • Test the agent in the Preview pane with product questions and edge cases.
Open Agent Studio and create a new agent

The Gemini Enterprise Agent Platform provides Agent Studio as a low-code visual designer for building, testing, and deploying agents directly from the Google Cloud Console. You'll create an agent here and give it a system instruction that defines its role.

  • In the Google Cloud Console, navigate to the Agents page.
  • Click Create agent to open the Agent Studio canvas.
  • In the Flow tab, click on your main agent to open the Details panel on the right.
  • In the Name field, enter Retail Support Agent.
  • In the Description field, enter Enterprise customer support agent for retail product inquiries.
  • In the Instructions field, enter a system instruction that frames the agent as a retail customer support specialist:
You are a customer support specialist for a retail company. Your role is to help customers find product information, compare options, and answer questions about pricing and availability.

Rules:
- Only answer questions using the product catalog data provided through grounding.
- If a question is outside the scope of the product catalog, politely explain that you can only help with product-related inquiries.
- Always cite specific product names and prices from the catalog when answering.
- Be concise, friendly, and professional.

What do these instructions accomplish?

The system instruction constrains the agent to only answer from grounded data. This is a key architectural pattern for enterprise agents.

By explicitly telling the agent to decline out-of-scope questions, you prevent hallucination. On the PCA renewal exam, this maps to data governance and responsible AI design.

Why use Agent Studio instead of code?

The PCA renewal exam tests architectural decisions, not coding ability. Agent Studio lets you focus on model selection, grounding strategy, and security posture.

This mirrors how a Cloud Architect evaluates the platform before recommending it to stakeholders.

Select the model and configure grounding

Model selection is one of the most frequently tested architectural decisions on the PCA renewal exam. You need to justify why a specific model fits the workload.

  • In the Details panel, find the Model dropdown.
  • Select Gemini 2.5 Flash from the model list.

Why Gemini 2.5 Flash over a larger model?

For retrieval-grounded responses, the model primarily synthesizes retrieved context rather than reasoning from scratch. Flash is optimized for exactly this pattern: lower latency, lower cost-per-token, and sufficient quality when grounding provides the facts.

On the exam, you would justify this choice as: the workload does not require complex multi-step reasoning, so paying for a larger model (like Gemini 3.1 Pro) wastes budget without improving output quality. This is a cost optimization decision mapped to the Well-Architected Framework.

Now connect your agent to the RAG corpus you created in the previous step.

  • In the Google Cloud Console, go to the Create prompt page in Agent Studio.
  • Select Grounding: Your data.
  • Select RAG Engine as the grounding source.
  • From the Corpus list, select the corpus you created in Step 2.
  • In the Top-K Similarity field, leave the default value of 20.
  • Click Save.

What is Top-K Similarity?

Top-K Similarity controls how many relevant chunks the retrieval engine returns to the model before it generates a response. A value of 20 means the model receives up to 20 of the most semantically similar text chunks from your corpus as context.

Higher values give the model more context but increase token usage and cost. For a small product catalog, 20 is more than sufficient.

What is RAG Engine doing behind the scenes?

When a user asks a question, RAG Engine searches your corpus for semantically relevant chunks using the text-embedding-005 embeddings you configured earlier. It then passes those chunks to Gemini 2.5 Flash as additional context alongside the user's question.

The model generates its response using that retrieved context, which means answers are grounded in your actual data rather than the model's general training knowledge.

Don't see your corpus in the list?

Make sure you are in the same region (us-central1) where you created the corpus. RAG Engine corpora are regional resources.

Also verify that your user account has the roles/aiplatform.user role, which is required to view and select corpora.

Why can't I see my RAG corpus when configuring grounding?

Test your grounded agent in the Preview pane

Testing is where you verify that grounding actually works. You need to confirm the agent answers from your catalog data and does not hallucinate when asked about topics outside its scope.

  • Return to your agent in the Flow tab and open the Preview pane.
  • Type a product question that matches your catalog data. For example:
What wireless headphones do you carry, and what are their prices?
  • Review the response. The agent should reference specific products from your product_catalog.json file, including names and prices.
  • Now test an out-of-scope question to verify the agent declines gracefully:
What is the return policy for damaged items?
  • The agent should politely explain that it can only help with product-related inquiries from the catalog.
  • Try one more product query to confirm consistency:
Compare the most expensive and least expensive products in the electronics category.
  • Verify the response references real products with accurate pricing from your catalog.

What should I see in the responses?

Grounded responses should cite specific product names and prices that match your uploaded catalog. You may also see grounding metadata indicating which chunks the model used.

If the agent invents products or prices not in your catalog, grounding is not configured correctly. Go back and verify the corpus selection in your grounding configuration.

Agent giving generic answers without catalog data?

Confirm that you selected the correct corpus in the grounding configuration and clicked Save.

Check that your product_catalog.json was successfully imported into the corpus in Step 2. You can verify by running a retrieval query against the corpus in Cloud Shell.

My agent is not using my product catalog data when answering questions.

Your enterprise agent is live and answering questions grounded in real product data. Next up, you'll lock down the security posture and document the architectural decisions that map directly to the PCA renewal exam format.

Apply Security and Document Architectural Decisions

Your agent works. It retrieves product data and generates grounded responses. But on the PCA renewal exam, a working solution is only half the answer.

The exam's case study format asks you to justify why you made each architectural choice. In this step, you will audit your agent's security posture, tighten IAM permissions to least-privilege, and create a decision document that maps every choice to the Well-Architected Framework.

In this step, get ready to:
  • Audit and tighten IAM permissions on the agent's service account.
  • Document architectural decisions covering model selection, grounding, security, and cost.
  • Map each decision to the Well-Architected Framework pillars.
Review and tighten IAM

The PCA renewal exam frequently tests whether you can apply least-privilege access to AI workloads. Your agent's platform service account should have only the permissions it needs to access the data store.

  • Return to Cloud Shell and review your project's current IAM policy by running this command:
gcloud projects get-iam-policy [[PROJECT_ID="your-project-id"]] --format=json

What does this command do?

This retrieves the full IAM policy for your project in JSON format. You will see a list of bindings, each containing a role and the members (users or service accounts) who hold that role.

Scan the output for any service account bindings that look too broad. For example, roles/editor or roles/owner on the agent's service account would be a red flag.

  • Look for the Agent Platform service agent in the output. Its email follows the pattern service-PROJECT_NUMBER@gcp-sa-aiplatform-re.iam.gserviceaccount.com.
  • Find your project number by running:
gcloud projects describe [[PROJECT_ID="your-project-id"]] --format="value(projectNumber)"
  • Confirm this service account has the Discovery Engine User role (roles/discoveryengine.user). If it does not, grant it by running this command:
gcloud projects add-iam-policy-binding [[PROJECT_ID="your-project-id"]] \
  --member='serviceAccount:service-[[PROJECT_NUMBER="your-project-number"]]@gcp-sa-aiplatform-re.iam.gserviceaccount.com' \
  --role='roles/discoveryengine.user'

Why Discovery Engine User specifically?

This role grants read-only access to data stores used for grounding. The agent can retrieve documents from your RAG corpus without being able to modify or delete them.

On the exam, choosing the narrowest role that still lets the workload function is the expected answer for any IAM question.

  • If you spot any overly broad roles on the agent service account (like roles/editor), remove them by running:
gcloud projects remove-iam-policy-binding [[PROJECT_ID="your-project-id"]] \
  --member='serviceAccount:service-[[PROJECT_NUMBER="your-project-number"]]@gcp-sa-aiplatform-re.iam.gserviceaccount.com' \
  --role='roles/editor'

What does this command do?

This removes a specific IAM binding from your project. The --member flag identifies the service account and the --role flag specifies which role to revoke.

Only run this if you actually see a broad role in your policy output. If the service account already has only roles/discoveryengine.user, no removal is needed.

  • Verify the updated policy by running:
gcloud projects get-iam-policy [[PROJECT_ID="your-project-id"]] --format=json
  • Confirm that service-PROJECT_NUMBER@gcp-sa-aiplatform-re.iam.gserviceaccount.com appears only under roles/discoveryengine.user.

Not seeing the service agent in the policy?

The Agent Platform service agent (service-PROJECT_NUMBER@gcp-sa-aiplatform-re.iam.gserviceaccount.com) is automatically created when you enable the Agent Platform API. Make sure you replace PROJECT_NUMBER with your actual numeric project number (not the project ID string).

You can find your project number in the Google Cloud Console dashboard or by running gcloud projects describe followed by your project ID.

Help me find the Agent Platform service agent in my IAM policy

Document your architectural decisions

The PCA renewal exam is 90-100% case study questions. Each case study describes a business problem and asks you to choose and justify a solution. Creating a decision document now trains the exact skill the exam tests.

  • Open Cloud Shell Editor (or any text editor you prefer) and create a new file called architecture_decisions.md.
  • Structure your document with four sections covering the decisions you made in this project. Use the template below as a starting point:
# Architectural Decision Document: Enterprise RAG Agent

## 1. Model Selection: Gemini 2.5 Flash vs Gemini 3.1 Pro

**Decision:** Gemini 2.5 Flash
**Rationale:** For retrieval-grounded workloads, the model primarily synthesizes
retrieved context rather than reasoning from scratch. Flash provides sufficient
quality at lower per-token cost. Pro would be justified for complex multi-step
reasoning tasks without grounding support.

## 2. Grounding Approach: RAG Engine vs Fine-Tuning

**Decision:** RAG Engine with Cloud Storage data source
**Rationale:**
- Data freshness: product catalog updates are reflected immediately without retraining
- No training cost: fine-tuning requires compute-intensive training runs
- Data governance: enterprise data stays in Cloud Storage under your IAM controls
- Separation of concerns: model logic and data are decoupled

## 3. Security Posture

**Decision:** Dedicated service accounts with least-privilege IAM roles
**Rationale:**
- Agent platform service account gets only Discovery Engine User role
- No data exfiltration risk: the agent cannot write to external destinations
- Service accounts are scoped per-workload, not shared across projects
- Audit trail: all access is logged via Cloud Audit Logs

## 4. Cost Model

**Decision:** Pay-per-token with no provisioned throughput
**Rationale:**
- Workload is bursty (customer queries), not sustained high-throughput
- No idle compute costs: serverless model scales to zero
- Flash pricing is significantly lower than Pro for equivalent token volume
- RAG Engine charges only for embedding and retrieval operations performed

Why document decisions this way?

Each section follows the same pattern: state the decision, then justify it with concrete rationale. This mirrors how the PCA exam presents answer choices.

When the exam asks which model a team should select, the correct answer always pairs the choice with the business justification. Practicing this format builds the habit.

  • Customize the template with details specific to your project. Add your actual project ID, the number of products in your catalog, and any observations from testing.
  • Save your file.
Map decisions to the Well-Architected Framework

Google Cloud's Well-Architected Framework has six pillars. The exam expects you to justify solutions across multiple pillars simultaneously.

  • Add a new section to your architecture_decisions.md file that maps each architectural choice to the relevant framework pillars:
## 5. Well-Architected Framework Mapping

| Pillar | How This Project Addresses It |
|--------|-------------------------------|
| Operational Excellence | Observability built into managed Agent Platform. No custom monitoring infrastructure needed. |
| Security | IAM least-privilege on service accounts. Data stays in Cloud Storage under project-level controls. No credential sharing. |
| Reliability | Fully managed Agent Runtime and RAG Engine. No single points of failure to manage. |
| Performance Optimization | Gemini 2.5 Flash selected for retrieval-grounded workloads. Chunking parameters tuned (512/100) for product catalog size. |
| Cost Optimization | Flash over Pro reduces per-token cost. Pay-per-use model eliminates idle compute. No fine-tuning training runs. |
| Sustainability | Serverless architecture means no idle compute. Resources scale to zero when not in use. |

What are the six pillars?

The Well-Architected Framework pillars are: Operational Excellence, Security, Reliability, Performance Optimization, Cost Optimization, and Sustainability.

On the exam, the strongest answers address multiple pillars at once. For example, choosing a managed service covers Reliability (no infrastructure to manage), Operational Excellence (built-in monitoring), and Sustainability (no idle resources) simultaneously.

  • Save your completed architecture_decisions.md file.
  • Review the mapping table. Every row should connect back to a concrete decision you made in this project, not a generic best practice.

✔️ Awesome, I've got everything!

Great. Make sure you have saved architecture_decisions.md with all five sections complete.

ⓧ I'd like to double check the full code

# Architectural Decision Document: Enterprise RAG Agent

## 1. Model Selection: Gemini 2.5 Flash vs Gemini 3.1 Pro

**Decision:** Gemini 2.5 Flash
**Rationale:** For retrieval-grounded workloads, the model primarily synthesizes
retrieved context rather than reasoning from scratch. Flash provides sufficient
quality at lower per-token cost. Pro would be justified for complex multi-step
reasoning tasks without grounding support.

## 2. Grounding Approach: RAG Engine vs Fine-Tuning

**Decision:** RAG Engine with Cloud Storage data source
**Rationale:**
- Data freshness: product catalog updates are reflected immediately without retraining
- No training cost: fine-tuning requires compute-intensive training runs
- Data governance: enterprise data stays in Cloud Storage under your IAM controls
- Separation of concerns: model logic and data are decoupled

## 3. Security Posture

**Decision:** Dedicated service accounts with least-privilege IAM roles
**Rationale:**
- Agent platform service account gets only Discovery Engine User role
- No data exfiltration risk: the agent cannot write to external destinations
- Service accounts are scoped per-workload, not shared across projects
- Audit trail: all access is logged via Cloud Audit Logs

## 4. Cost Model

**Decision:** Pay-per-token with no provisioned throughput
**Rationale:**
- Workload is bursty (customer queries), not sustained high-throughput
- No idle compute costs: serverless model scales to zero
- Flash pricing is significantly lower than Pro for equivalent token volume
- RAG Engine charges only for embedding and retrieval operations performed

## 5. Well-Architected Framework Mapping

| Pillar | How This Project Addresses It |
|--------|-------------------------------|
| Operational Excellence | Observability built into managed Agent Platform. No custom monitoring infrastructure needed. |
| Security | IAM least-privilege on service accounts. Data stays in Cloud Storage under project-level controls. No credential sharing. |
| Reliability | Fully managed Agent Runtime and RAG Engine. No single points of failure to manage. |
| Performance Optimization | Gemini 2.5 Flash selected for retrieval-grounded workloads. Chunking parameters tuned (512/100) for product catalog size. |
| Cost Optimization | Flash over Pro reduces per-token cost. Pay-per-use model eliminates idle compute. No fine-tuning training runs. |
| Sustainability | Serverless architecture means no idle compute. Resources scale to zero when not in use. |

Keep this document for exam prep

This decision document is a study tool. Before the exam, reread it and practice explaining each choice aloud in 30 seconds or less. The exam gives you about 2 minutes per question, so concise justification is key.

Your agent is now secured with least-privilege IAM and documented with exam-ready architectural justifications. Next up, you will take on the Secret Mission and compare RAG Engine against Agent Search for grounding.

Secret mission

Compare RAG Engine vs Agent Search

You've built a RAG-grounded agent using RAG Engine. But GCP offers a second grounding architecture: Agent Search. In this mission, you'll deploy the same data through Agent Search and evaluate which approach wins on accuracy, cost, and latency. This is the exact architectural comparison the PCA renewal exam expects you to make.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project uses pay-per-use GCP services, so leaving resources in place incurs minimal ongoing costs (pennies for Cloud Storage, small charges for RAG Engine and Agent Search queries).

Cost warning

While idle costs are low, the RAG Engine corpus and Agent Search data store may incur small embedding, indexing, or query charges if other services interact with them. If you are done with this project, choose Pause or Delete to avoid unexpected charges.

Resources you used:

  • Cloud Storage bucket (enterprise-agent-data-bucket) containing your product catalog.
  • RAG Engine corpus (indexed product data with embeddings).
  • Agent Search data store (unstructured document index from Cloud Storage).
  • Agent Studio agent (grounded retail customer support agent).
  • Dedicated service account (agent-workload-sa) with least-privilege IAM roles.
  • IAM policy bindings on your project (roles/aiplatform.user, roles/storage.admin).

Keep everything running

No action needed. Choose this if you are still actively studying for the PCA renewal exam and want to revisit or extend this agent.

  • Your Cloud Storage bucket stores a small file and costs fractions of a cent per month.
  • The RAG corpus and Agent Search data store remain available for retrieval queries.
  • The Agent Studio agent stays accessible in the Console for testing.

Pause - I'll come back to this later

Shut down the active agent runtime to reduce any query-triggered costs, but keep the data and corpus in place so you can resume later.

  • In the Google Cloud Console, navigate to the Agents page in Agent Studio.
  • Delete the deployed agent (this removes the runtime but not your corpus or data store).
  • Keep your Cloud Storage bucket, RAG corpus, and Agent Search data store intact for future use.

Delete - I don't want to use this again

Remove all project resources and start fresh. Run these commands in Cloud Shell or your local terminal.

Delete the Agent Studio agent by navigating to the Agents page in the Google Cloud Console, clicking the options menu next to your agent, and selecting Delete.

Delete the Agent Search data store:

  • In the Google Cloud Console, go to the AI Applications page.
  • Click Data Stores in the navigation menu.
  • Find your data store, click the options menu, then click Delete.

Delete the RAG corpus by running this command in Cloud Shell:

curl -X DELETE \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://us-central1-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/us-central1/ragCorpora/RAG_CORPUS_ID"

How do I find my RAG_CORPUS_ID?

If you did not save your corpus ID earlier, list all corpora in your project by running:

curl -X GET \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://us-central1-aiplatform.googleapis.com/v1/projects/PROJECT_ID/locations/us-central1/ragCorpora"

Look for the corpus with the display name you used during creation. The numeric ID at the end of the resource name is your RAG_CORPUS_ID.

Delete the Cloud Storage bucket and all its contents by running:

gcloud storage rm --recursive gs://enterprise-agent-data-bucket

Delete the dedicated service account by running:

gcloud iam service-accounts delete agent-workload-sa@PROJECT_ID.iam.gserviceaccount.com

Clean up IAM policy bindings by running:

gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:YOUR_EMAIL" \
  --role="roles/aiplatform.user"

gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:YOUR_EMAIL" \
  --role="roles/storage.admin"

Nice Work!

Nice Work!

You just architected and deployed a RAG-grounded enterprise AI agent on Gemini Enterprise Agent Platform. This is the exact architectural pattern the PCA renewal exam tests through its case study questions.

You've learned how to:

  • Created a RAG corpus grounded in enterprise data from Cloud Storage using RAG Engine with custom chunking and embedding configuration.
  • Built and deployed a grounded enterprise agent in Agent Studio using Gemini 2.5 Flash, making deliberate model selection tradeoffs.
  • Applied least-privilege IAM security and documented architectural decisions mapped to the Well-Architected Framework pillars.
  • Secret Mission: Compared RAG Engine vs Agent Search grounding approaches and documented tradeoffs for enterprise decision-makers.

Ready to quiz yourself?