🏆

Gemini Code Assist Track — G11: Enterprise, Security & Capstone The enterprise picture — code customization, data governance, IP indemnification — then the capstone: build, test, review, and ship a brand-new service using everything from G01–G10.

Enterprise, Security & Capstone

Two audiences finish this course: developers who'll use the tool daily, and the people who must decide whether their organization can trust it. This module serves both — then hands you the keys for the capstone.

Code Customization: The Enterprise Differentiator

Analogy First

Every suggestion you've seen so far came from a tailor who has measured millions of people but never you specifically — excellent generic fit, occasionally wrong at the shoulders. Your organization's private code is your exact measurements: the internal billing-client library everyone must use, the bespoke error-handling middleware, the way your services talk to each other. Without those measurements, the tailor suggests requests.post(...) when your org mandates billing_client.submit() — correct in general, wrong here, every single time. Code customization hands the tailor your measurements: it indexes your private repositories so completions and chat answers come back in your organization's house style, using your internal libraries.

Technical Definition

Code customization (Enterprise edition) connects your private repositories — GitHub, GitLab, and other supported hosts, linked through Google Cloud's Developer ConnectA Google Cloud service that creates secure, OAuth-based connections between your Google Cloud project and external source-code hosts like GitHub and GitLab. — to a private index in your Google Cloud project. Gemini then performs retrievalSearching an index for code snippets relevant to the current request and adding them to the model's context — the same RAG technique behind enterprise search. against that index for completions, generation, and chat (and, in current releases, in agent mode and Gemini CLI). Your code is not used to train the shared model — it's retrieved into context per-request, per-organization, access-controlled by your project's IAM.

Why It Matters

GEMINI.md (G05) can describe conventions in ~150 lines; it cannot teach the model your 400-repo internal ecosystem. For a bank with a mandatory internal crypto library, "suggestions that use our library" vs "generic suggestions we must rewrite" is the difference between AI assistance compounding your platform investment and quietly eroding it. That's the Enterprise price gap in one sentence — and why G00's advice was: buy it only if this paragraph describes you.

Security & Governance: The Questions Your CISO Will Ask

Question	Answer (Standard/Enterprise)
Is our code used to train Google's models?	No — prompts and code are excluded from model training under the Google Cloud terms. (Consumer/free tiers historically had different terms — one more reason teams license properly.)
Where does our code travel?	Encrypted in transit to Google Cloud's Gemini endpoints for inference; `.aiexclude` (G05) controls what can leave the machine at all.
What if AI output copies someone's code?	Source citations flag verbatim matches (G03); admins can block cited suggestions; and Google offers IP indemnification for generated-code copyright claims on paid tiers (conditions apply — e.g., citation features enabled).
Can we audit usage?	Yes — admin dashboards and Cloud Logging cover license use and activity metadata; Enterprise adds finer controls.
Can we control features per team?	Yes — release channels (GA vs preview), tool restrictions (G07), and org policies let admins shape what's available.
What's the riskiest feature to govern?	Agent auto-approve + MCP with untrusted content (G07's prompt-injection brief). Policy answer: approval gates on by default, auto-approve only in isolated environments.

Gotcha

Terms and guarantees change — verify, don't memorize. Before presenting to your security team, re-read the current data governance documentation and the indemnification terms for your edition. This course teaches you which questions matter; the docs of record answer them for your contract date.

The Working Rules (Course in Ten Lines)

Your file is the prompt — names, comments, and open tabs steer everything (G02).
Spec-comments beat wishes — WHAT / WHICH / WHERE / WHAT-IF (G02).
Feed evidence verbatim — errors and tracebacks, never paraphrased (G03).
Read what you accept — you own every line that enters the codebase (G01–G04).
Failures are information — generated tests that fail usually indict your design (G04).
Write the rules down once — GEMINI.md for generation, styleguide.md for review, the same standards at both gates (G05, G09).
Exclude secrets mechanically — .aiexclude, not vigilance (G05).
Chat to decide, agent to execute — and intervene at the plan, the cheapest gate (G06).
Scope every credential — agents inherit your tokens' power (G07).
Verify independently — your terminal's pytest and git diff, not the agent's claim (G06–G10).

Capstone: The Meal Planner Service

No new concepts — just everything at once, on a brand-new service you build from an empty folder. The Meal Planner is a small Flask API that consumes your Recipe Box data and plans a week of meals. You are the architect and reviewer; Gemini does the labor at every stage.

The Spec

meal-planner — a Flask + SQLite API with:

POST /plans — body: {"days": 1-7, "max_minutes_per_meal": int, "required_tags": [..]}. Picks one recipe per day from Recipe Box data (read recipes.db directly or call the Recipe Box API — your architectural call, justify it), no recipe repeated within a plan. Returns 201 with the plan; 400 on invalid input; 409 if there aren't enough matching recipes.
GET /plans/<id> — returns a stored plan; 404 when missing.
GET /plans/<id>/shopping-list — aggregated ingredient list across the plan's recipes, de-duplicated.
Full pytest suite with a temp-DB fixture; GEMINI.md and .aiexclude from day zero; a GitHub repo with the PR-review app installed; at least one feature shipped via agent mode and one PR reviewed by the bot before merge; deployed to Cloud Run (or local Docker fallback).

Foundation (G05 skills) — rules before code

New folder, git init, then write GEMINI.md (architecture rules: storage layer separation, JSON errors with correct status codes incl. the 409 rule, type hints, test requirements) and .aiexclude (*.db, .env) before any code exists. Starting with the rulebook is the professional order — every generated line afterward obeys it.

Core build (G02–G03 skills) — comments and chat

Build storage.py (plans table; spec-comments per function) and the plan-picking logic in planner.py via comment-driven generation. Use chat (/explain) to pressure-test the picking algorithm: "what happens when required_tags match only 2 recipes but days=5?" — that's your 409 path. Verify each function with a harness before moving on.

Tests first-class (G04 skills)

Generate the pytest suite (temp-DB fixture from the start — you know why now). Aim for: happy path per endpoint, every declared error status (400/404/409), no-repeat invariant, shopping-list de-duplication. Tests green before any agent work.

Agent feature (G06–G07 skills)

Ship one full feature via agent mode, ticket-style prompt, plan reviewed before execution: "Add GET /plans/<id>/nutrition-estimate: rough calorie estimate per day based on an ingredients→calories lookup table module, unknown ingredients counted as 0 and listed in the response, tests included." Review diffs against your GEMINI.md; verify independently.

Review gate (G09 skills)

Push to GitHub, install the review app, commit .gemini/config.yaml + styleguide.md (same standards as your GEMINI.md), open the nutrition feature as a PR, and process the bot's findings with the fix / push-back / interrogate discipline. Merge only when re-review is clean.

Ship it (G10 skills)

Production-shape it (requirements.txt, Procfile, PORT, debug off), deploy to Cloud Run via /deploy or gcloud run deploy --source . (or Docker locally), exercise every endpoint against the live URL, read the logs, then tear down.

What success looks like

Your implementation details will differ (Gemini generates the code; you set the contract) — but these behaviors must match. Use this as your diff target before the rubric:

expected output — the Meal Planner contract in action

PS> curl -X POST http://localhost:5003/plans -H "Content-Type: application/json" -d "{\"days\":3,\"max_minutes_per_meal\":30,\"required_tags\":[\"vegan\"]}"
{"plan_id":1,
 "days":[{"day":1,"recipe_id":4,"recipe":"Chickpea Curry","minutes":25},
         {"day":2,"recipe_id":9,"recipe":"Lentil Tacos","minutes":20},
         {"day":3,"recipe_id":2,"recipe":"Veggie Stir Fry","minutes":15}],
 "criteria":{"days":3,"max_minutes_per_meal":30,"required_tags":["vegan"]}}   <-- 201
# invariant: no recipe_id repeats within the plan

# not enough matching recipes (only 2 vegan quick recipes, 5 days asked):
{"error":"only 2 recipes match the criteria; 5 days requested"}              <-- 409

# bad input (days=0):
{"error":"days must be between 1 and 7"}                                     <-- 400

PS> curl http://localhost:5003/plans/1/shopping-list
{"plan_id":1,
 "items":[{"ingredient":"chickpeas","used_in":1},
          {"ingredient":"onion","used_in":3},        <-- de-duplicated across recipes
          {"ingredient":"tortillas","used_in":1}]}                           <-- 200

PS> curl http://localhost:5003/plans/999
{"error":"plan 999 not found"}                                               <-- 404

PS> pytest tests/ -q
..................                                              [100%]
18 passed in 0.52s   # count varies; every status code and the
                     # no-repeat invariant must each have a test

Grade yourself

Rules first: GEMINI.md + .aiexclude existed before the first generated line, and at least one generated suggestion visibly followed a rule you wrote

Contract correctness: 201 / 400 / 404 / 409 all implemented and each covered by a test

Algorithm honesty: the no-repeat invariant and the not-enough-recipes 409 path both have tests that fail if the logic regresses

Agent discipline: you corrected the agent's plan or rejected at least one diff hunk (if you approved everything blindly, redo Phase 4)

Review discipline: at least one bot finding fixed AND one pushed back on with reasoning

Independent verification: final pytest run and live-URL curl checks done from your own terminal

Lifecycle complete: the service ran on a public URL (or local container), and you can explain the SQLite-persistence caveat to a colleague

All seven? You're not a Gemini Code Assist user anymore — you're a practitioner. 5–6: revisit the corresponding module's lab. Fewer: do the capstone again in a week; it compresses fast on the second pass.

What's Next

Pick a domain capstone: four real-industry projects extend this course into career tracks — Data Engineering (UCC lien pipeline), API (B2B order tracking), Backend (healthcare pre-auth rules engine), and Frontend (ops dashboard).
Go deep on the terminal: the sibling Building with Gemini CLI course (18 modules) — spec-driven development, extensions, GitHub Actions automation, Google Cloud MCP.
Compare your options: AI CLI Tools Compared puts Gemini side-by-side with Claude Code and GitHub Copilot.
Build your own agents: the Building AI Agents flagship course teaches the engineering underneath tools like agent mode.
Stay current: watch the release notes — this product ships monthly, and (per G00) the individual-tier Antigravity migration is live news.

Final Knowledge Check

1. How does code customization use your private repos?

It retrains Google's shared model on your code

It builds a private, IAM-controlled index and retrieves relevant snippets into context per-request — no training on your code

It uploads your repos to a public dataset

It only reads repository names

2. Your CISO asks: "what stops generated code from creating copyright exposure?" The layered answer is…

Nothing — it's an unmanaged risk

Source citations surface verbatim matches, admins can block cited suggestions, and paid tiers carry Google's IP indemnification (conditions apply)

The model is incapable of reproducing existing code

3. The capstone demanded GEMINI.md before any code because…

Standing rules steer every subsequent generation — writing them first means zero lines are produced under the wrong conventions

The extension refuses to start without one

It's required for git to work

Purely ceremonial

4. Which rubric item directly tests whether you stayed "the reviewer" with agents?

Deploying to Cloud Run

Having corrected a plan or rejected at least one diff hunk — blind approval means the gates taught you nothing

Writing the shopping-list endpoint

Using SQLite

5. The single thread connecting all 12 modules is…

AI makes human judgment unnecessary

Faster typing

Delegate the labor, keep the judgment: specify intent precisely, review at every gate, verify independently — at growing scales from ghost text to deployed systems

Always use the most expensive edition

🎉 Course Complete!

You've covered the full Gemini Code Assist surface: completion, chat, context, agents, MCP, CLI, PR reviews, cloud, and enterprise. Go build.