Gemini coverage

Two audit-log connectors bring Gemini use at your company under Trefur, with no code changes: Google Workspace for Gemini in Docs, Sheets and Gmail, and Vertex AI for the apps your teams build.

Choose your path

Trade-off summary. The two connectors compose: most companies run both.

Path	Setup effort	Latency	What we see	User attribution	Best for
Workspace audit log	Google Workspace OAuth	5-15 min lag	Gemini-in-Apps generation events (Docs / Sheets / Gmail)	Workspace user → Trefur user binding	Knowledge-worker usage attribution + license efficiency
Vertex AI audit log	GCP OAuth, one click	1-5 min lag	Metadata only (no prompt/completion text)	principalEmail bound to user record	Inventory + discovery — find every Gemini agent, attribute every call

Path 1 — Google Workspace audit log

For knowledge-worker Gemini usage (Docs / Sheets / Gmail / Meet summaries), connect Google Workspace via OAuth and Trefur ingests the gemini_in_apps admin reports plus generation events from each app. Useful for attributing every employee's Gemini activity to a Trefur-tracked agent record without per-user setup.

# Sources → Connections → Google Workspace → Connect
# Required scopes:
#   https://www.googleapis.com/auth/admin.reports.audit.readonly

# What gets ingested (both Reports API applications):
#   - applications/gemini_in_workspace_apps  (Docs / Sheets / Gmail / Drive)
#   - applications/gemini                    (standalone gemini.google.com under Workspace)

# Surfaces:
#   Drive / Docs / Sheets / Gmail Gemini-generated content events
#   Standalone gemini.google.com prompt-submission events
#   Per-user generation counts for license / usage attribution

For developer Gemini usage (apps calling generativelanguage.googleapis.com or aiplatform.googleapis.com), use Path 2 below.

Path 2 — Vertex AI audit log

The CISO connects Trefur to GCP via OAuth once. Trefur polls Cloud Audit Logs for every Vertex AI prediction call, registers each unique principal as an observed agent, and binds the call to a Trefur user record via principalEmail. No SDK install, no proxy traffic redirect, no per-application changes — this is the path that scales to a 50,000-employee company.

# Sources → Connections → Vertex AI Audit Logs → Connect
# (You'll be redirected to Google for OAuth consent.)

# Required scopes (already requested by the connector):
#   https://www.googleapis.com/auth/logging.read

# What gets ingested (two surfaces, one connector):
#   1. Vertex AI:    resource.type = "aiplatform.googleapis.com/Model"
#                    methodName = GenerateContent / StreamGenerateContent / CountTokens / Predict / RawPredict
#   2. Cloud Assist: serviceName = "cloudaicompanion.googleapis.com"
#                    Covers "Explain this error", "Generate Terraform",
#                    Code Assist, and the in-console Gemini chat.

# Per call, Trefur records the calling principal (bound to a user),
# the Gemini model, token usage, and any tool calls the model made.
# Cloud Audit Logs do NOT include prompt or completion text.

Cloud Audit Logs do not include prompt or completion text. For prompt+completion content scanning (PII, secrets, tool misuse), layer OpenTelemetry traces from your agents on top.

Per-call content: OpenTelemetry traces

For prompt, completion and tool-call detail from the agents you own, send their OpenTelemetry traces to Trefur over OTLP/HTTP. Spans that follow the OpenTelemetry GenAI semantic conventions need no mapping; the quickstart shows the exporter settings.