Startups moving from AI Studio prototypes to production on Google Cloud must answer ten specific questions to avoid security risks, unexpected bills, and scaling failures—starting with choosing the right entry point, setting up projects securely, authenticating correctly, timing the migration, managing consumption modes, batching workloads, enforcing spend caps, securing secrets, and implementing agent safeguards.
Onboard: foundation decisions for AI Studio and Agent Platform
Start with Google AI Studio for rapid prototyping using a raw API key and the google-genai SDK, then migrate to Gemini Enterprise Agent Platform before real users arrive to gain enterprise controls like IAM, VPC Service Controls, and logging. The unified SDK supports both: prototype with api_key, production with vertexai=True and project/location settings. Treat them as sequential stages, not interchangeable options.
Set up a production-ready Google Cloud project without becoming an IAM expert by using the Cloud Setup checklist and Architecture Framework for opinionated folder hierarchy, enabling required APIs in bulk after linking a billing account, and letting Gemini suggest narrow IAM roles via the role picker—prompting for 'least privileged' access to avoid over-privileged service accounts.
Authenticate code using service accounts with least-privilege IAM roles (e.g., roles/aiplatform.user) instead of raw API keys or user credentials; rely on Application Default Credentials (ADC) so the Google Auth library handles token acquisition silently, and never store keys in code or .env files—use Secret Manager for any third-party secrets.
Migrate from AI Studio’s API key to Agent Platform’s IAM model when any of these occur: the key leaves your laptop, multiple team members need access, monthly spend exceeds a few hundred dollars, or you’re onboarding paying customers—revoke all existing keys, confirm no api_key= arguments remain, enable aiplatform.googleapis.com, and test ADC locally before cutover.
Scale: avoid 429s and choose the right consumption model
Monitor serving metrics via the prebuilt Model observability dashboard in Cloud Console under Agent Platform → Dashboard, and alert on aiplatform.googleapis.com/publisher/online_serving/model_invocation_count with error_category=capacity to isolate genuine throttling from bad requests—note that Standard PayGo (DSQ) doesn’t support 80%-of-quota alerts due to its shared, transient nature.
Choose consumption mode based on traffic patterns: use Standard PayGo (DSQ) for early-stage, spiky prototype work; add Priority PayGo (global endpoint + X-Vertex-AI-LLM-Request-Type: priority header) for revenue-critical bursts that can’t tolerate 429s; only buy Provisioned Throughput (PT) after measuring baseline TPM for weeks to cover predictable load, letting overflow spill to PayGo—avoid buying PT too early as it charges whether used or not.
Move non-interactive workloads (e.g., nightly summarization, background classification, embedding backfills) to Batch Prediction via client.batches.create() with JSONL inputs in Cloud Storage—this runs in a separate queue, doesn’t consume interactive DSQ, and costs roughly half of on-demand inference, freeing headroom for latency-sensitive user-facing requests.
Govern: enforce controls on costs, keys, and agent behavior
Complete four actions this week: audit and rotate any raw API keys in repos, notebooks, or runtime; move asynchronous workloads to the Batch API; enable the Model observability dashboard with a capacity-error alert; and set a spend cap on your project, monitoring for 50% and 80% warnings—these steps put you ahead of most startups shipping AI features on Google Cloud.
What to do next
Answering these ten questions isn’t about perfection—it’s about building observable, controllable, and secure foundations early. Start small, measure real usage, and layer in safeguards as you grow. Revisit these decisions quarterly as your traffic patterns and team evolve.
FAQ
When should I switch from Standard PayGo to Priority PayGo?
Switch to Priority PayGo when you encounter revenue-critical traffic that cannot tolerate 429 errors—it’s a configuration change using the global endpoint and specific headers, not a purchase order, and can be toggled per request.
How do I know if my workload is a good fit for Batch Prediction?
If the user can tolerate a delay of seconds to minutes—such as for nightly summarization, background classification, or evaluation runs—move it to Batch Prediction to save cost and free interactive quota for latency-sensitive user requests.
What’s the safest way to authenticate my Cloud Run service to Agent Platform?
Attach a service account with only the roles/aiplatform.user role (or narrower) to your Cloud Run deployment and rely on Application Default Credentials—your code calls the genai.Client with vertexai=True and no api_key, letting the Auth library handle token retrieval silently.
Source: 10 questions every startup should answer before moving to production with their AI prototype (GCP).
