Google Model Armor Pricing, Limits, and Cost Scope

Google Model Armor pricing is public and token-based. Google lists 2 million tokens per month at no charge, followed by $0.10 per additional 1 million tokens for direct Model Armor use. Security Command Center subscription tiers include 3 billion tokens per month. Gemini Enterprise includes Model Armor. Those figures need an architecture and capacity worksheet before they become a budget.

TL;DR

• Google lists 2 million Model Armor tokens per month at no charge, then $0.10 for each additional 1 million tokens.
• Security Command Center subscription tiers include 3 billion tokens monthly, with the same published additional-usage rate above that amount.
• Model Armor is included with Gemini Enterprise. Buyers should avoid budgeting the same screening volume twice.
• Capacity review should include 1,200 QPM per project, a 4 MB file limit, and filter-specific token limits. It should also cover logging and integration costs plus support terms.

Google Model Armor pricing uses screened tokens

The Model Armor pricing section lists a free tier of up to 2 million tokens each month. Additional use costs $0.10 per 1 million tokens. The table applies this public pay-as-you-go shape to direct Model Armor use and to Security Command Center Premium at organization or project level.

The same page says Security Command Center Premium and Enterprise subscriptions include 3 billion Model Armor tokens per month, with usage above 3 billion tokens carrying the published $0.10 per additional 1 million tokens rate. Gemini Enterprise includes Model Armor across its editions.

Keep each entitlement attached to its parent agreement and billing account. Included capacity may already cover a buyer with Gemini Enterprise or a Security Command Center subscription. Another project can still use the direct free tier and pay-as-you-go path.

Prompt and response volume sets the usage base

Google's Model Armor overview shows an application sending an incoming prompt for inspection, forwarding the prompt or sanitized prompt to the LLM, then screening the generated response before returning it. One conversational turn can therefore create screened token volume on both sides of the model call.

Start with real distributions. Build the forecast from actual prompt and response sizes rather than raw request count alone, including system instructions and retrieved context when those tokens enter the screened payload. Separate text from supported files and images.

Split production and test traffic by Google Cloud project so quota and cost ownership remain visible. Track staging and validation traffic in that same project map.

I would distrust any Model Armor estimate built from "monthly chats." Tokens are the published meter. One long retrieved document can outweigh hundreds of short prompts.

Bundles change the ledger

Security Command Center subscriptions and Gemini Enterprise can change which team owns the commercial line. The security organization may carry a Security Command Center agreement with included Model Armor capacity, while a business-unit deployment may consume Model Armor through Gemini Enterprise. Direct API use can appear under a Google Cloud project with its own billing and quota settings.

Create a ledger. Record the parent product, billing account, project, integration, included monthly tokens, forecast tokens, and overage owner. The same sheet should identify which traffic can draw from each entitlement.

Do not assume coverage. Inclusion in one subscription should never be assumed to cover unrelated direct API projects without written confirmation.

The AI gateway architecture guide helps identify the model routes that could invoke screening, while the AI governance framework helps assign approval and evidence ownership around those routes. Use both before consolidating costs under one security budget.

Quotas and limits affect production sizing

Google's Model Armor quotas and system limits page lists 1,200 API queries per minute per project and 600 QPM per project for ExternalProcessor requests used in certain integrations. Google classifies these as quotas, which can typically be adjusted. Fixed system limits require payload or application design changes.

The page sets a 4 MB limit for supported files and images. Model Armor skips scanning a file or image above that size.

Filter limits differ. For prompt injection and jailbreak detection, Model Armor screens text up to 65,536 tokens. Responsible AI uses the same ceiling, as does the child sexual abuse material filter. Sensitive Data Protection uses a separate 0.5 MB payload limit described as approximately 130,000 English tokens.

Put these values beside a real payload trace. Mark the upload path in red at 4 MB. Mark the text path at 65,536 tokens. Those two marks will expose oversized documents before a load test turns them into skipped scans.

Adjacent cloud costs need separate lines

The public token price covers Model Armor screening. A complete deployment can also incur charges for logging and monitoring, network connectivity, Private Service Connect, VPC Service Controls, application compute, and model inference.

Support terms may follow the buyer's Google Cloud agreement. Integration work and incident-response retention can create additional internal costs.

Model Armor's overview says regional endpoint access from a VPC requires a Private Service Connect endpoint to avoid certificate errors with Private Google Access or VPC Service Controls. Put that requirement in the design and cost worksheet when regional endpoints are used.

The prompt injection prevention guide explains why content filtering belongs inside a layered control design. Model Armor can screen prompts and responses for named content threats. Identity-bound authorization and downstream tool permissions still need explicit owners. Independent decision evidence needs one too.

DeepInspect

DeepInspect governs authenticated HTTP traffic routed between users or agents and LLM endpoints. It evaluates identity, role, data classification, destination, and versioned policy for each request. Before allowed traffic proceeds, DeepInspect produces a tamper-evident decision record.

Model Armor can screen prompt and response content for injection, sensitive data, harmful content, malicious URLs, and supported files. DeepInspect adds identity-aware authorization and independent decision evidence at the routed model boundary.

Scope each layer against the request path it can inspect. Keep both costs visible. Book a technical deep dive at deepinspect.ai.