A2 · Tool workflow · software, financial services, healthcare, education, retail

In-product copilot

Help inside the product, scoped to one tenant, metered to the cent.

Customer job: Get a task done in the product without leaving the screen or reading the docs.
Today: Users open support tickets or abandon the feature; the product team cannot price AI features because usage is not attributed.
Accepted result: A suggestion the user applies, inside their tenant, with cost attributed to that tenant.

A SaaS product embeds an assistant that answers from the tenant's own data and proposes typed, reversible actions the user confirms. Every call carries the tenant ID through retrieval, the model gateway and the usage meter, so isolation and billing are provable.

Google Cloud / primary provider

What carries each step.

Keep vectors beside tenant rows in AlloyDB so row-level security applies to retrieval; meter through BigQuery exports.

Data and model estate in one place: Gemini on Agent Platform, Agent Search and RAG Engine, AlloyDB and BigQuery, Cloud Run for everything else.

Component	Service	Evidence
	Person
	Cloud Run	prior, ga
	Cloud Armor + Load Balancing	prior, ga
	Identity Platform	prior, ga
	Cloud Run	prior, ga
	Apigee (AI gateway policies)	prior, ga
	Gemini 3.8 Flash (Agent Platform)	source, ga
	AlloyDB for PostgreSQL	prior, ga
	MCP server on Cloud Run	prior, ga
	AlloyDB for PostgreSQL	prior, ga
	BigQuery + Looker Studio	prior, ga
	Cloud Logging, Monitoring, Trace	prior, ga
	Evaluation service (Agent Platform)	confirm

Customer view / judgement, not benchmark

Weigh what this customer values.

Remove providers that fail a hard constraint first: residency, data rights, identity estate, latency, operating owner, budget. Then weigh the rest. Scores are architect judgement on a 1-5 scale for the pattern as specified, recorded with a rationale. They are not benchmarks. A provider's consumption opportunity never changes a customer score.

Performance×1Does the default path meet the latency and quality budget for this workload?Time to value×1How quickly does a team reach a first accepted result with managed parts?Speed to execution×1How much undifferentiated wiring stands between the design and a running slice?Cost per accepted result×1How predictable and low is the all-attempt cost at the stated volume?Exit cost×1How cheaply can the workload move models, data or runtime later?Governance fit×1Do identity, residency, audit and policy controls exist without custom building?

Performance 5Time to value 5Speed to execution 5Cost per accepted result 4Exit cost 4Governance fit 3
The most direct fit for a Next.js SaaS; isolation proof is on the application team.
Performance 4Time to value 4Speed to execution 4Cost per accepted result 4Exit cost 4Governance fit 4
Database-enforced isolation; Postgres compatibility keeps exit cost moderate.
Performance 5Time to value 4Speed to execution 4Cost per accepted result 5Exit cost 3Governance fit 3
Isolation by construction at low cost; data residency per tenant needs design.
Performance 4Time to value 3Speed to execution 3Cost per accepted result 4Exit cost 4Governance fit 5
Strong cost attribution; more assembly.
Performance 4Time to value 4Speed to execution 4Cost per accepted result 4Exit cost 5Governance fit 2
Simple and portable; governance is entirely self-built.
Performance 4Time to value 3Speed to execution 3Cost per accepted result 3Exit cost 3Governance fit 5
Good governance; search units make many small tenants expensive.

Provider ledger / shown after the choice

What grows on Google Cloud.

These meters are the provider team’s consumption view. They explain the cloud workload; they never raise a customer score.

Gemini input and output tokens
Cloud Run vCPU-seconds and requests
Agent Search queries and index storage
AlloyDB or Cloud SQL instance hours
BigQuery slots or bytes scanned

Take it with you / generated from one specification

Exact views, and a running start.

Google Cloud views

SVG diagram for decks and documents
diagrams.net file editable, shared IDs
React Flow JSON for your own canvas
Mermaid flowchart

Every provider

Structurizr workspace C4 containers, one deployment view per provider
Journey sequence (Mermaid)

One-click template / ai-architect-answer/v1

Grounded answers on Cloud Run with Gemini 3.8 Flash on Agent Platform

Model: gemini-3.8-flash on the global endpoint. Auth: Service account Application Default Credentials.

Deploy to Google Cloud Read the source

Evidence: local-tested: conformance suite, installed @google/genai client options and a local server run in fixture mode. Not yet verified: Container build, Cloud Run Button flow and a live Gemini call. The button builds from the engine’s main branch.

Customer ledger / assumptions you can move

Cost per accepted result.

Every attempt is charged, so failed runs count. Value comes only from accepted results. Illustrative assumption measured as user time saved; revenue from pricing the feature is a separate ledger.

Primary metric: Applied suggestions per active tenant. Suggestions applied without undo within 24 hours, per active tenant per week.

Monthly value: €38,500
Monthly cost: €3,850
Net: €34,650
Cost per accepted result: €0.40

Eligible tasks per month50,000Share attempted with the system35 in 100Attempts accepted without rework55 in 100Minutes saved per accepted result4 minValue of an hour of that work€60.00Run cost per attempt€0.02Fixed monthly cost (hosting, review, support)€3,500

Experience / drawn from the specification

What the person sees, including no.

Screens are rendered from structured blocks in the catalog, so a refusal or an exception is designed before it happens. Values marked fixture are illustrations, not measurements.

Why did churn rise in the DACH segment last month?

Three enterprise accounts in Germany cancelled after the price change on 1 September; they make up 71 percent of the rise. Fixture data.

Create retention task list

Copilot paneldesktop · success

Create 3 tasks in Retention board

+ Call Fabrikam GmbH owner
+ Offer annual plan to Northwind AG
+ Review pricing exception for Contoso DE

ApplyCancel

Confirm actiondesktop · approval

Assists this monthfixture

Appliedfixture

Metered costfixture

Tenant usagedesktop · default

Summarise today's open invoices

12 open, 3 overdue (EUR 8,420). Fixture data.

Copilot on mobilemobile · success

Team workflow / who carries what

Every lane leaves evidence.

Lane	Responsibility	Evidence it leaves
Customer	Ask, review the diff, confirm or undo	Apply and undo events
AI	Answer from tenant data; propose typed actions	Proposal with diff
System	Tenant scope, budgets, metering	Per-tenant usage export
Reviewer	Product manager reviews applied-versus-undone by feature	Weekly feature report
Operator	Finance prices the feature from metered cost	Cost per tenant

Release evaluations

What must pass before anyone ships.

Cross-tenant leakage
0 responses containing another tenant's data
Seeded canary records per tenant; adversarial prompts.
Write confirmation
100 percent of writes preceded by confirmation
Action-layer audit in staging.
Applied suggestion rate
Tracked per feature; release blocks on a 20 percent drop
Product analytics.
First token
p95 <= 1.5 s
Gateway telemetry.

Risks and controls

What would go wrong first.

Data from one tenant appears for another.
Tenant from session only; namespaced index; tenant in cache key; canary probes.
One tenant consumes the AI budget.
Per-tenant budget at the gateway and plan-based limits.
Assistant changes data without consent.
Dry-run diff and confirmation enforced in the action layer.

Image recipes / concept art only

When to generate, and when never to.

16:9 · gpt-image-2 or a current Gemini image model

Customer moment for a proposal cover or portal hero.

Cinematic editorial photograph, late afternoon light, shallow depth of field. Get a task done in the product without leaving the screen or reading the docs. The moment just after the accepted result: A suggestion the user applies, inside their tenant, with cost attributed to that tenant. Real workplace, restrained palette of deep navy, warm paper and one cobalt accent. Natural expressions, no screens facing the camera. Concept art only. Do not render product logos, cloud icons, UI text or architecture labels; compose exact labels from the specification in code.

3:2 · gpt-image-2 (consistent characters across panels)

Team workflow storyboard for a workshop or executive briefing.

Five-panel storyboard, clean ink line with flat colour, consistent characters across panels. Panels follow the lanes customer, ai, system, reviewer, operator: (1) Ask, review the diff, confirm or undo (2) Answer from tenant data; propose typed actions (3) Tenant scope, budgets, metering (4) Product manager reviews applied-versus-undone by feature (5) Finance prices the feature from metered cost Each panel shows hands and decisions, not screens. Concept art only. Do not render product logos, cloud icons, UI text or architecture labels; compose exact labels from the specification in code.

Do not generate

Any image a customer will read for component names, data classes or provider services.

Do not generate. Export the compiled view for the chosen provider. A generated architecture image can invent services, misspell names and draw icons the vendor never published.

A design, not a deployment: no realization on this page carries a provider receipt. Generated from the pattern source at revision c43825efda38. Apache-2.0 for catalog content and exports; provider names are trademarks of their owners; Google Cloud icons retain Google rights.

Next pattern: Support resolution agent