cs.SEAug 30, 2026
SaveTowards Agentic Cloud Engineering: Graph and Loop Engineering with a Zero-Trust Agent Harness
Organizations: Tata Research Development and Design Centre
Abstract
Agentic AI is enabling cloud-based workflows in which autonomous agents reason over operational state, invoke authorized tools, modify software and infrastructure, deploy services, verify execution outcomes, and adapt across long-horizon, multistep tasks. Engineering such workflows requires explicit mechanisms for workflow progression, constrained execution, failure recovery, and verifiable completion. We present Agentic Cloud Workflow Engineering, an agentic AI framework that transforms natural-language agentic cloud-engineering tasks into validated code repositories and verified operational cloud deployments for automating cloud-based agentic workflows. The framework separates three complementary concerns: graph engineering specifies long-horizon workflow progression and verification-dependent transitions; loop engineering provides bounded diagnosis, repair or re-planning, retry, and re-verification; and agent harness engineering enforces zero-trust execution through identity, authorization, policy-scoped capabilities, isolation, and runtime safeguards. Workflow progression and completion require machine-checkable repository, deployment, and runtime evidence, with recovery constrained by explicit operational bounds and termination criteria. We instantiate the framework on Google Cloud and evaluate repository completeness, controlled execution, evidence-gated progression, operational deployment, and bounded recovery. Experimental results show that executions terminate with either a verified operational cloud deployment or an auditable terminal failure under bounded recovery. The framework provides a unified engineering architecture for cloud-based workflows spanning Agentic DevOps, Agentic CloudOps, Agentic SRE/AIOps, Agentic SecOps, Agentic DataOps, Agentic MLOps/LLMOps, AgentOps, Agentic RAG/GraphRAG, and related cloud-engineering domains.
Figures & tables
Figure 1: The figure shows an Agentic Cloud Workflow Engineering architecture for synthesizing, configuring, deploying, and verifying agentic workflows across DevOps, CloudOps, SRE/AIOps, SecOps, DataOps, MLOps/LLMOps, and related cloud-engineering domains. The Graph Orchestrator coordinates repository generation, review, execution and deployment, verification, and runtime monitoring through graph-structured workflows with bounded recovery. Verification failures or adverse runtime evidence trigger diagnosis, repair, re-planning, and retry, after which execution resumes through the Graph Orchestrator. The agent harness enforces per-action authorization, policy-scoped tool access, isolation, state, observability, audit, and evidence controls across execution and recovery paths. Repository generation, review, diagnosis, and repair use VS Code and Chrome sandboxes, whereas deployment and verification actions execute within the gVisor-isolated GKE Agent Sandbox. The software supply chain governs build, security validation, provenance, and controlled deployment. Evidence-gated completion requires a validated code repository, verified cloud deployment, and verified runtime evidence.
Figure 2: The figure shows the Agentic Cloud Workflow Engineering architecture integrating graph engineering, loop engineering, and a zero-trust agent harness. The Graph Orchestrator uses Google Agent Development Kit (ADK) to coordinate long-horizon workflow execution, while Agent2Agent (A2A) supports inter-agent delegation and task exchange and Model Context Protocol (MCP) provides scoped access to sandboxes, authorized cloud APIs, and tenant-scoped data services. Verification failures or adverse runtime evidence activate bounded diagnosis, repair, re-planning, retry, and re-verification. The agent harness enforces identity and authorization, policy, isolation, state and tenancy, network and runtime security, software supply-chain, observability, and evidence controls across execution and recovery paths. Evidence-gated completion requires a validated code repository, verified operational cloud deployment, and verified runtime evidence.
Figure 3: The figure shows the realization of Agentic Cloud Workflow Engineering on Google Cloud. Graph and bounded loop engineering execute on regular GKE, while a zero-trust agent harness governs per-action authorization, policy-scoped capability access, isolated execution, state and tenancy, software delivery, observability, and evidence collection. Verification failures, adverse runtime evidence, or failed evidence checks trigger bounded diagnosis, repair or re-planning, and retry through the Graph Orchestrator. Workflow completion is gated by machine-checkable evidence of repository validity, operational deployment, and runtime behavior.
| RQ | Evaluated Property | Evaluation Basis | Metric | Measurement | Range |
|---|---|---|---|---|---|
| RQ1 | Verified Task Completion | Nominal execution | Fraction of nominal executions satisfying repository, deployment, and runtime verification. | ||
| RQ2 | Evidence-Gated Progression | Repository-, deployment-, and runtime-verification perturbations | Fraction of perturbation executions in which verification-dependent progression remains blocked while the required verification condition is unsatisfied. | ||
| RQ3 | Bounded Recovery | Repository-, deployment-, and runtime-verification perturbations | Fraction of induced verification failures successfully corrected and re-verified with fresh evidence before an applicable recovery bound is exhausted. | ||
| RQ4 | Per-Action Authorization and Policy Enforcement | Authorization-policy condition with matched authorized and unauthorized capability requests | , | Fractions of unauthorized or out-of-scope requests denied before invocation and matched authorized requests permitted for invocation, respectively. | |
| RQ5 | Bounded Termination | Recovery-budget-exhaustion condition | Fraction of exhaustion-condition executions terminating in an auditable failure state while the required verification condition remains unsatisfied. | ||
| RQ6 | Cross-Domain Applicability | RQ1–RQ5 metrics stratified across 14 domains | Cross-domain summary | Cross-domain average and lowest observed domain value for each primary metric. |
Table 1: Evaluation metrics aligned with RQ1–RQ6 and the controlled execution conditions. The upward arrow indicates that higher values are better.
| Model | Verified | VTCR |
|---|---|---|
| Gemini 2.5 Flash-Lite | 79/140 | 56.4% |
| Gemini 2.5 Flash | 96/140 | 68.6% |
| Gemini 2.5 Pro | 115/140 | 82.1% |
| GPT-5.6 Sol | 133/140 | 95.0% |
Table 2: RQ1: Verified Task Completion Rate (VTCR).
| Model | Correctly Gated | EGER |
|---|---|---|
| Gemini 2.5 Flash-Lite | 420/420 | 100.0% |
| Gemini 2.5 Flash | 420/420 | 100.0% |
| Gemini 2.5 Pro | 420/420 | 100.0% |
| GPT-5.6 Sol | 420/420 | 100.0% |
Table 3: RQ2: Evidence-Gated Execution Rate (EGER).
| Model | Successful | RSR |
|---|---|---|
| Gemini 2.5 Flash-Lite | 214/420 | 51.0% |
| Gemini 2.5 Flash | 278/420 | 66.2% |
| Gemini 2.5 Pro | 321/420 | 76.4% |
| GPT-5.6 Sol | 391/420 | 93.1% |
Table 4: RQ3: Recovery Success Rate (RSR).
| Model | Repository | Deployment | Runtime |
|---|---|---|---|
| Gemini 2.5 Flash-Lite | 79/140 (56.4%) | 73/140 (52.1%) | 62/140 (44.3%) |
| Gemini 2.5 Flash | 103/140 (73.6%) | 94/140 (67.1%) | 81/140 (57.9%) |
| Gemini 2.5 Pro | 116/140 (82.9%) | 108/140 (77.1%) | 97/140 (69.3%) |
| GPT-5.6 Sol | 134/140 (95.7%) | 131/140 (93.6%) | 126/140 (90.0%) |
Table 5: RQ3: Recovery success by verification-perturbation type.
| Model | UCDR | ACPR |
|---|---|---|
| Gemini 2.5 Flash-Lite | 140/140 (100.0%) | 139/140 (99.3%) |
| Gemini 2.5 Flash | 140/140 (100.0%) | 139/140 (99.3%) |
| Gemini 2.5 Pro | 140/140 (100.0%) | 139/140 (99.3%) |
| GPT-5.6 Sol | 140/140 (100.0%) | 139/140 (99.3%) |
Table 6: RQ4: Per-action authorization and policy enforcement.
| Model | Correct Terminations | BTR |
|---|---|---|
| Gemini 2.5 Flash-Lite | 140/140 | 100.0% |
| Gemini 2.5 Flash | 140/140 | 100.0% |
| Gemini 2.5 Pro | 140/140 | 100.0% |
| GPT-5.6 Sol | 140/140 | 100.0% |
Table 7: RQ5: Bounded Termination Rate (BTR).
| Metric | Gemini 2.5 Flash-Lite | Gemini 2.5 Flash | Gemini 2.5 Pro | GPT-5.6 Sol |
|---|---|---|---|---|
| VTCR | 56.4% (40.0%) | 68.6% (50.0%) | 82.1% (60.0%) | 95.0% (80.0%) |
| EGER | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) |
| RSR | 51.0% (33.3%) | 66.2% (50.0%) | 76.4% (60.0%) | 93.1% (83.3%) |
| UCDR | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) |
| ACPR | 99.3% (90.0%) | 99.3% (90.0%) | 99.3% (90.0%) | 99.3% (90.0%) |
| BTR | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) | 100.0% (100.0%) |
Table 8: RQ6: Cross-domain average with the lowest observed domain value in parentheses.
| Ablated Configuration | Metric | Full Framework | Ablated Variant |
|---|---|---|---|
| No recovery loop | VTCR | 133/140 (95.0%) | 18/140 (12.9%) |
| Model-determined progression | EGER | 420/420 (100.0%) | 416/420 (99.0%) |
Table 9: Ablation results for GPT-5.6 Sol. Full-framework values are the corresponding RQ1 and RQ2 baselines.
| Domain | Generate / Synthesize New System | Modify / Operate Existing System |
|---|---|---|
| DevOps | Generate application code, tests, CI/CD pipelines, and build and release configurations. | Fix failing tests, repair code, rebuild, scan, and release. |
| CloudOps | Generate Terraform, Kubernetes manifests, and cloud-infrastructure configurations. | Provision, modify, scale, or repair Kubernetes and cloud infrastructure. |
| SRE/AIOps | Generate monitoring rules, remediation workflows, runbooks, and recovery automation. | Detect incidents, diagnose failures, remediate, and verify recovery. |
| SecOps | Generate security policies, detection rules, hardening configurations, and remediation artifacts. | Investigate vulnerabilities, perform authorized containment, and verify remediation. |
| DataOps | Generate data pipelines, transformations, schemas, orchestration, and validation logic. | Repair failed pipelines, replay workloads, and verify outputs. |
| MLOps | Generate training, evaluation, deployment, and monitoring pipelines. | Retrain or replace models, modify pipelines, deploy, and verify serving behavior. |
Table 10: Representative system-synthesis and operational tasks supported across cloud-engineering domains.
Figure 4: Graph engineering: explicit workflow structure governing transitions, conditional branches, dependencies, recovery paths, and progression conditions [ OpenAI, 2025 , Anthropic, 2024 ] .
Figure 5: Loop engineering: bounded diagnosis, repair or re-planning, retry, and re-verification driven by execution or verification feedback [ OpenAI, 2026a , Anthropic, 2024 ] .
Figure 6: Agent harness engineering: controlled mediation of model-generated actions through capability authorization, policy and approval gates, state, sandboxed execution, recovery state, observability, and audit [ OpenAI, 2026b , Anthropic, 2025 ] .
Figure 7: High-level organization of Agentic Cloud Workflow Engineering , integrating graph-controlled workflow progression, bounded recovery, policy-constrained capability use and execution, and machine-checkable evidence for verified completion or bounded terminal failure.
More in this topic
Agentic Workflows
Agentic workflows coordinate AI agents, tools, and humans across multi-step tasks, emphasizing reliable execution, efficiency, and oversight.
See all 219 papers