Google attestation profile for Gemini Enterprise, Agent Search, Document AI, and Knowledge Catalog

[1wgrumph]

Migrated from private source issue alphazede/bran-dev#13

Goal

Define a BRAN attestation and policy profile over Google-managed enterprise retrieval products.

Use Google products for the capabilities they already provide:

• Gemini Enterprise and Agent Search for connectors, retrieval, and enterprise search
• Document AI for PDF, DOCX, PPTX, XLSX, OCR, layout, and chunk extraction
• Knowledge Catalog for BigQuery metadata, governance, and lineage

BRAN remains the deterministic policy, attestation, provenance, replay, DLP, public-boundary, and bounded-evidence layer. It must not become a competing connector framework, search engine, document parser, or metadata catalog.

Responsibility boundary

Google-managed products own:

• provider connectivity and supported synchronization
• enterprise search and retrieval
• native document parsing and chunking
• BigQuery metadata discovery and lineage
• provider IAM and end-user access enforcement

BRAN owns:

• offline capability declarations
• owner-approved source and tenant allowlists
• exact provider, connector, processor, and policy identities when available
• opaque account references rather than credentials
• source/revision/generation/entry evidence and explicit unavailable fields
• normalized output digests and checkpoint receipts
• deterministic replay fixtures
• DLP, classification, public-boundary, byte-budget, and packet-admission decisions
• typed stale, conflict, permission_unavailable, history_incomplete, quota_exhausted, location_mismatch, and perimeter_denied outcomes

V1 integration surfaces

Gemini Enterprise and Agent Search

• Accept only explicitly configured data-store, engine, connector, tenant, and source references.
• Record connector/data-store identity, selected filters, access-control mode, query/result digest, truncation, and any available revision evidence.
• Treat federated, indexed, and imported results as different capability states.
• Keep search-only profiles read-only; do not enable Drive or provider actions.
• Never claim source-revision or permission completeness when the product does not attest it.

Document AI

• Record processor and processor-version identity, location, input source digest, normalized output digest, page/item limits, and parser limitations.
• Wrap validated outputs with the evidence envelope defined in Remove MIT license option from LICENSE file #5.
• Do not execute or follow active content and external relationships.

Knowledge Catalog

• Use catalog entry identity, asset type, source system, metadata revision evidence, policy tags, and lineage references when available.
• Keep BigQuery rows and arbitrary SQL out of V1.
• Do not claim catalog metadata or lineage is a complete authorization proof.

Direct API fallback

Direct Cloud Storage, Drive, BigQuery, or repository APIs are not parallel V1 adapters. A direct read-only adapter requires a separate issue proving that the managed Google product cannot provide a required attestation or evidence field.

Existing BRAN Git and OKF snapshot behavior remains the path for repository and OKF evidence.

Authentication and deployment boundary

• Provider access is opt-in and disabled in the default local profile.
• Use Application Default Credentials, attached service accounts, or Workload Identity Federation for approved Google Cloud workloads.
• Use the narrowest read-only Workspace scope; Drive actions and domain-wide delegation require separate owner/security approval.
• Never accept, persist, log, or return service-account JSON keys, OAuth refresh tokens, access tokens, cookies, or signed URLs.
• Preserve project, tenant, location, quota/billing project, and VPC Service Controls context where available.
• No IAM, sharing, source, index, catalog, or provider-resource mutations.

Acceptance criteria

• A design document defines the Google attestation profile and responsibility matrix.
• A deterministic source-attestation/checkpoint schema references the evidence envelope from Remove MIT license option from LICENSE file #5.
• A capability matrix distinguishes Gemini Enterprise, Agent Search, Document AI, Knowledge Catalog, existing BRAN Git/OKF support, and unavailable evidence.
• Synthetic fixtures cover each managed integration plus partial permissions, incomplete revisions, truncation, stale/conflicting checkpoints, DLP rejection, quota failure, location mismatch, and network-disabled behavior.
• Same attested provider output and BRAN policy produce the same normalized evidence digest.
• Default capability discovery and tests perform no provider or network calls.
• Negative tests prove cross-tenant/source escape, secret reflection, unauthorized action requests, unsupported completeness claims, and mixed-revision snapshots fail closed.
• BRAN packets preserve native locator, exact attested identity, derivation path, permission-evidence status, fidelity, and truncation.
• Dependency, license, OAuth/IAM, retention, cost, and public-boundary review is required only before a concrete live adapter is selected.

Non-goals

• Reimplementing Gemini Enterprise or Agent Search connectors/search.
• Reimplementing Document AI parsing.
• Reimplementing Knowledge Catalog metadata or lineage.
• Building direct GCS, BigQuery, Drive, or repository connector suites in V1.
• Mirroring customer estates, querying arbitrary BigQuery rows, or becoming a general cloud browser.
• Enabling provider actions, changing IAM/sharing, or combining customer security domains.
• Live Google integration without a separately approved project, identity, budget, and adapter issue.

Implementation gate

Implementation starts only after the owner selects one concrete GCP MVP integration and approves its dependency, scope, IAM/OAuth, cost, retention, and security boundary. The recommended first proof is an attested Cloud Storage object generation or Document AI output, not a general connector platform.

Related work

• Remove MIT license option from LICENSE file #5 defines the BRAN evidence envelope.
• Export bran-dev 3feeba3 public snapshot #11 covers database evidence boundaries.
• build(ci): add monthly grouped Dependabot updates #12 covers the single-tenant server/job-isolation boundary.
• Existing BRAN Git and OKF support remain the repository/bundle path.

References

• Gemini Enterprise connectors: https://cloud.google.com/gemini-enterprise/connectors
• Agent Search data stores: https://cloud.google.com/generative-ai-app-builder/docs/create-data-store-es
• Document AI layout parser: https://cloud.google.com/document-ai/docs/layout-parse-chunk
• Knowledge Catalog with BigQuery: https://cloud.google.com/bigquery/docs/use-knowledge-catalog

[1wgrumph]

Comment by @1wgrumph on original issue:

Scope decision: use Gemini Enterprise and Agent Search for connectors/search, Document AI for document parsing, and Knowledge Catalog for BigQuery metadata/lineage. BRAN remains the deterministic attestation, provenance, replay, DLP/public-boundary, and bounded-evidence layer. Direct provider adapters require a separately proven gap and owner-approved implementation issue. No implementation agent has been dispatched.

[1wgrumph]

Comment by @1wgrumph on original issue:

Completed on bran-dev main at 9ac1537ac45b8e87d36c096bfec8803e0728d962. The Google attestation profile, deterministic fixtures/oracles, and bounded offline Document AI recorded-response adapter are integrated. The adapter consumes current documentLayout blocks, preserves exact processor-version identity, emits deterministic #5/#13 records, and fails closed when permission, DLP, hazard, or input-binding evidence is unavailable. Independent Park Ranger review: ACCEPT with no findings. Validation: publish hygiene PASS; full gate PASS (fast, conformance, security, performance, sealed-release self-test). The downstream public export remains a separate owner-controlled action and was not modified by this closeout.

[1wgrumph]

Closed in original repository (bran-dev#13).