cs.SEAug 30, 2026

Towards Agentic Cloud Engineering: Graph and Loop Engineering with a Zero-Trust Agent Harness

Authors: Sagar Srinivas Sakhinana, Venkataramana Runkana

Organizations: Tata Research Development and Design Centre

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Agentic AI is enabling cloud-based workflows in which autonomous agents reason over operational state, invoke authorized tools, modify software and infrastructure, deploy services, verify execution outcomes, and adapt across long-horizon, multistep tasks. Engineering such workflows requires explicit mechanisms for workflow progression, constrained execution, failure recovery, and verifiable completion. We present Agentic Cloud Workflow Engineering, an agentic AI framework that transforms natural-language agentic cloud-engineering tasks into validated code repositories and verified operational cloud deployments for automating cloud-based agentic workflows. The framework separates three complementary concerns: graph engineering specifies long-horizon workflow progression and verification-dependent transitions; loop engineering provides bounded diagnosis, repair or re-planning, retry, and re-verification; and agent harness engineering enforces zero-trust execution through identity, authorization, policy-scoped capabilities, isolation, and runtime safeguards. Workflow progression and completion require machine-checkable repository, deployment, and runtime evidence, with recovery constrained by explicit operational bounds and termination criteria. We instantiate the framework on Google Cloud and evaluate repository completeness, controlled execution, evidence-gated progression, operational deployment, and bounded recovery. Experimental results show that executions terminate with either a verified operational cloud deployment or an auditable terminal failure under bounded recovery. The framework provides a unified engineering architecture for cloud-based workflows spanning Agentic DevOps, Agentic CloudOps, Agentic SRE/AIOps, Agentic SecOps, Agentic DataOps, Agentic MLOps/LLMOps, AgentOps, Agentic RAG/GraphRAG, and related cloud-engineering domains.

Figures & tables

Figure 1: The figure shows an Agentic Cloud Workflow Engineering architecture for synthesizing, configuring, deploying, and verifying agentic workflows across DevOps, CloudOps, SRE/AIOps, SecOps, DataOps, MLOps/LLMOps, and related cloud-engineering domains. The Graph Orchestrator coordinates repository generation, review, execution and deployment, verification, and runtime monitoring through graph-structured workflows with bounded recovery. Verification failures or adverse runtime evidence trigger diagnosis, repair, re-planning, and retry, after which execution resumes through the Graph Orchestrator. The agent harness enforces per-action authorization, policy-scoped tool access, isolation, state, observability, audit, and evidence controls across execution and recovery paths. Repository generation, review, diagnosis, and repair use VS Code and Chrome sandboxes, whereas deployment and verification actions execute within the gVisor-isolated GKE Agent Sandbox. The software supply chain governs build, security validation, provenance, and controlled deployment. Evidence-gated completion requires a validated code repository, verified cloud deployment, and verified runtime evidence.
Figure 2: The figure shows the Agentic Cloud Workflow Engineering architecture integrating graph engineering, loop engineering, and a zero-trust agent harness. The Graph Orchestrator uses Google Agent Development Kit (ADK) to coordinate long-horizon workflow execution, while Agent2Agent (A2A) supports inter-agent delegation and task exchange and Model Context Protocol (MCP) provides scoped access to sandboxes, authorized cloud APIs, and tenant-scoped data services. Verification failures or adverse runtime evidence activate bounded diagnosis, repair, re-planning, retry, and re-verification. The agent harness enforces identity and authorization, policy, isolation, state and tenancy, network and runtime security, software supply-chain, observability, and evidence controls across execution and recovery paths. Evidence-gated completion requires a validated code repository, verified operational cloud deployment, and verified runtime evidence.
Figure 3: The figure shows the realization of Agentic Cloud Workflow Engineering on Google Cloud. Graph and bounded loop engineering execute on regular GKE, while a zero-trust agent harness governs per-action authorization, policy-scoped capability access, isolated execution, state and tenancy, software delivery, observability, and evidence collection. Verification failures, adverse runtime evidence, or failed evidence checks trigger bounded diagnosis, repair or re-planning, and retry through the Graph Orchestrator. Workflow completion is gated by machine-checkable evidence of repository validity, operational deployment, and runtime behavior.
RQEvaluated PropertyEvaluation BasisMetricMeasurementRange
RQ1Verified Task CompletionNominal executionVTCR\mathrm{VTCR}Fraction of nominal executions satisfying repository, deployment, and runtime verification.[0,1] ↑[0,1]\,\uparrow
RQ2Evidence-Gated ProgressionRepository-, deployment-, and runtime-verification perturbationsEGER\mathrm{EGER}Fraction of perturbation executions in which verification-dependent progression remains blocked while the required verification condition is unsatisfied.[0,1] ↑[0,1]\,\uparrow
RQ3Bounded RecoveryRepository-, deployment-, and runtime-verification perturbationsRSR\mathrm{RSR}Fraction of induced verification failures successfully corrected and re-verified with fresh evidence before an applicable recovery bound is exhausted.[0,1] ↑[0,1]\,\uparrow
RQ4Per-Action Authorization and Policy EnforcementAuthorization-policy condition with matched authorized and unauthorized capability requestsUCDR\mathrm{UCDR} , ACPR\mathrm{ACPR}Fractions of unauthorized or out-of-scope requests denied before invocation and matched authorized requests permitted for invocation, respectively.[0,1] ↑[0,1]\,\uparrow
RQ5Bounded TerminationRecovery-budget-exhaustion conditionBTR\mathrm{BTR}Fraction of exhaustion-condition executions terminating in an auditable failure state while the required verification condition remains unsatisfied.[0,1] ↑[0,1]\,\uparrow
RQ6Cross-Domain ApplicabilityRQ1–RQ5 metrics stratified across 14 domainsCross-domain summaryCross-domain average and lowest observed domain value for each primary metric.[0,1] ↑[0,1]\,\uparrow
Table 1: Evaluation metrics aligned with RQ1–RQ6 and the controlled execution conditions. The upward arrow indicates that higher values are better.
ModelVerifiedVTCR
Gemini 2.5 Flash-Lite79/14056.4%
Gemini 2.5 Flash96/14068.6%
Gemini 2.5 Pro115/14082.1%
GPT-5.6 Sol133/14095.0%
Table 2: RQ1: Verified Task Completion Rate (VTCR).
ModelCorrectly GatedEGER
Gemini 2.5 Flash-Lite420/420100.0%
Gemini 2.5 Flash420/420100.0%
Gemini 2.5 Pro420/420100.0%
GPT-5.6 Sol420/420100.0%
Table 3: RQ2: Evidence-Gated Execution Rate (EGER).
ModelSuccessfulRSR
Gemini 2.5 Flash-Lite214/42051.0%
Gemini 2.5 Flash278/42066.2%
Gemini 2.5 Pro321/42076.4%
GPT-5.6 Sol391/42093.1%
Table 4: RQ3: Recovery Success Rate (RSR).
ModelRepositoryDeploymentRuntime
Gemini 2.5 Flash-Lite79/140 (56.4%)73/140 (52.1%)62/140 (44.3%)
Gemini 2.5 Flash103/140 (73.6%)94/140 (67.1%)81/140 (57.9%)
Gemini 2.5 Pro116/140 (82.9%)108/140 (77.1%)97/140 (69.3%)
GPT-5.6 Sol134/140 (95.7%)131/140 (93.6%)126/140 (90.0%)
Table 5: RQ3: Recovery success by verification-perturbation type.
ModelUCDRACPR
Gemini 2.5 Flash-Lite140/140 (100.0%)139/140 (99.3%)
Gemini 2.5 Flash140/140 (100.0%)139/140 (99.3%)
Gemini 2.5 Pro140/140 (100.0%)139/140 (99.3%)
GPT-5.6 Sol140/140 (100.0%)139/140 (99.3%)
Table 6: RQ4: Per-action authorization and policy enforcement.
ModelCorrect TerminationsBTR
Gemini 2.5 Flash-Lite140/140100.0%
Gemini 2.5 Flash140/140100.0%
Gemini 2.5 Pro140/140100.0%
GPT-5.6 Sol140/140100.0%
Table 7: RQ5: Bounded Termination Rate (BTR).
MetricGemini 2.5 Flash-LiteGemini 2.5 FlashGemini 2.5 ProGPT-5.6 Sol
VTCR56.4% (40.0%)68.6% (50.0%)82.1% (60.0%)95.0% (80.0%)
EGER100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)
RSR51.0% (33.3%)66.2% (50.0%)76.4% (60.0%)93.1% (83.3%)
UCDR100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)
ACPR99.3% (90.0%)99.3% (90.0%)99.3% (90.0%)99.3% (90.0%)
BTR100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)100.0% (100.0%)
Table 8: RQ6: Cross-domain average with the lowest observed domain value in parentheses.
Ablated ConfigurationMetricFull FrameworkAblated Variant
No recovery loopVTCR133/140 (95.0%)18/140 (12.9%)
Model-determined progressionEGER420/420 (100.0%)416/420 (99.0%)
Table 9: Ablation results for GPT-5.6 Sol. Full-framework values are the corresponding RQ1 and RQ2 baselines.
DomainGenerate / Synthesize New SystemModify / Operate Existing System
DevOpsGenerate application code, tests, CI/CD pipelines, and build and release configurations.Fix failing tests, repair code, rebuild, scan, and release.
CloudOpsGenerate Terraform, Kubernetes manifests, and cloud-infrastructure configurations.Provision, modify, scale, or repair Kubernetes and cloud infrastructure.
SRE/AIOpsGenerate monitoring rules, remediation workflows, runbooks, and recovery automation.Detect incidents, diagnose failures, remediate, and verify recovery.
SecOpsGenerate security policies, detection rules, hardening configurations, and remediation artifacts.Investigate vulnerabilities, perform authorized containment, and verify remediation.
DataOpsGenerate data pipelines, transformations, schemas, orchestration, and validation logic.Repair failed pipelines, replay workloads, and verify outputs.
MLOpsGenerate training, evaluation, deployment, and monitoring pipelines.Retrain or replace models, modify pipelines, deploy, and verify serving behavior.
Table 10: Representative system-synthesis and operational tasks supported across cloud-engineering domains.
Figure 4: Graph engineering: explicit workflow structure governing transitions, conditional branches, dependencies, recovery paths, and progression conditions [ OpenAI, 2025 , Anthropic, 2024 ] .
Figure 5: Loop engineering: bounded diagnosis, repair or re-planning, retry, and re-verification driven by execution or verification feedback [ OpenAI, 2026a , Anthropic, 2024 ] .
Figure 6: Agent harness engineering: controlled mediation of model-generated actions through capability authorization, policy and approval gates, state, sandboxed execution, recovery state, observability, and audit [ OpenAI, 2026b , Anthropic, 2025 ] .
Figure 7: High-level organization of Agentic Cloud Workflow Engineering , integrating graph-controlled workflow progression, bounded recovery, policy-constrained capability use and execution, and machine-checkable evidence for verified completion or bounded terminal failure.
More in this topic

Agentic Workflows

Agentic workflows coordinate AI agents, tools, and humans across multi-step tasks, emphasizing reliable execution, efficiency, and oversight.

See all 219 papers

Explore similar work

CardsList
Aug 30, 2026

Graph, Loop, and Harness Engineering for Zero-Trust Agentic Data Engineering and Analytical Processing

Large language model agents increasingly automate data workflows, but end-to-end cloud data engineering and analytical execution require reliable coordination across code, data, infrastructure, and runtime environments. We present two zero-trust frameworks. Zero-Trust Agentic Data Engineering generates, deploys, and verifies complete cloud data-engineering solutions from natural-language tasks, with completion conditioned on repository, deployment, runtime, and policy evidence. Zero-Trust Agentic OLAP combines governed Data Preparation with verified Online Analytical Processing (OLAP), permitting production promotion only after validation and evidence-bound approval, and releasing analytical answers only after Same-Snapshot Execution, Exact Result Equivalence, deterministic grounding, and reflection. Both frameworks share three abstractions: graph engineering for evidence-gated workflow structure, loop engineering for bounded recovery, and agent-harness engineering for zero-trust execution. We evaluate both frameworks under nominal execution, controlled failures, bounded recovery, and policy-constrained conditions, measuring verified completion, recovery, authorization enforcement, production promotion, and verified OLAP execution.

Sagar Srinivas Sakhinana, Venkataramana Runkana

Tata Research Development and Design Centre

Agentic WorkflowsRuntime Enforcement for AI AgentsZero-Trust Security
AskPDF
Aug 30, 2026

Forward-Deployed Full-Stack Engineering for Autonomous Cloud MLOps

Across industries, machine-learning systems support applications ranging from prediction and anomaly detection to forecasting, optimization, and scheduling, yet operationalizing these systems requires coordinating application development, model pipelines, cloud infrastructure, security, deployment, monitoring, retraining, recovery, and rollback. We present an evidence-gated multi-agent framework for transforming a natural-language MLOps cloud engineering task into a verified repository and operational cloud deployment. The framework combines graph engineering, loop engineering, and agent harness engineering. A stateful Graph Orchestrator coordinates specialized agents for repository generation, review, execution, verification, release, and monitoring while governing workflow dependencies, evidence gates, retry bounds, recovery paths, and termination. Consequential lifecycle transitions proceed only when their required predicates are supported by verifiable execution or runtime evidence. Verification failures activate bounded reflection, repair, and re-verification, while runtime evidence of failure, drift, degradation, or policy violation can trigger bounded adaptation, recovery, or rollback. Agent harness engineering constrains repository generation, review, and repair, artifact execution, and cloud operations through controlled capabilities and isolated execution environments. We realize the framework on Google Cloud Platform and evaluate repository completeness, controlled execution, evidence-gated transitions, cloud promotion, and bounded recovery. Our experimental results show that the framework prevents unsupported lifecycle transitions and drives each run toward either a verified operational deployment or an auditable terminal failure.

Sagar Srinivas Sakhinana, Venkataramana Runkana

Tata Research Development and Design Centre

MLOpsSoftware Engineering AgentsMulti-Agent OrchestrationAI Agent ReliabilityRuntime Enforcement for AI Agents
AskPDF
May 26, 2026

Agyn: An Open-Source Platform for AI Agents with Scalable On-Demand Execution, Agent Definition as a Code, and Zero-Trust Access

As organizations move toward production deployments of AI agents, which execute non-deterministic workflows, maintain stateful sessions, and often operate with privileged access to internal services, the engineering challenge shifts from building individual agents to operating them at scale with proper isolation, governance, and security. In this paper we present Agyn, an open-source platform designed around three key principles tailored for agent workloads: a signal-driven, stateful serverless runtime on Kubernetes; a Terraform provider for agent and harness definition; and a security model grounded in zero-trust and least-privilege principles. Agyn is agent-agnostic, model-agnostic, and cloud-agnostic.

Nikita Benkovich, Vitalii Valkov

Agyn, Inc. · Mila AI e-Lab

AI Agent SecurityAI Agent Governance
AskPDF