Source-linked AI summary
Towards Agentic Cloud Engineering: Graph and Loop Engineering with a Zero-Trust Agent Harness
Sagar Srinivas Sakhinana, Venkataramana Runkana
TL;DR
Agentic cloud workflows require explicit control over long-horizon progression, constrained execution, recovery, and verifiable completion. The paper presents a graph-, loop-, and harness-based framework that converts natural-language tasks into validated repositories and verified deployments; across a Google Cloud evaluation, executions achieve verified completion or auditable terminal failure under bounded recovery.
Problem
Agentic cloud workflows need explicit mechanisms for long-horizon progression, constrained execution, failure recovery, and verifiable completion across complex operational tasks.
Method
The framework combines graph-controlled progression, bounded diagnosis and recovery loops, and a zero-trust harness enforcing authorization, policy-scoped capabilities, isolation, and evidence controls.
Results
Across 3,360 executions, verified task completion varied by model, reaching 95.0% for GPT-5.6 Sol versus 56.4% for Gemini 2.5 Flash-Lite.
Takeaways & Limitations
The framework supports end-to-end verified cloud-workflow execution by decoupling machine-checkable progression enforcement from model-dependent recovery capability.
Takeaways & Limitations
The evaluation is limited to Google Cloud, controlled failure conditions, fixed recovery budgets, predefined verification predicates, and limited adversarial testing.
Abstract
from arXiv · showhide
Agentic AI is enabling cloud-based workflows in which autonomous agents reason over operational state, invoke authorized tools, modify software and infrastructure, deploy services, verify execution outcomes, and adapt across long-horizon, multistep tasks. Engineering such workflows requires explicit mechanisms for workflow progression, constrained execution, failure recovery, and verifiable completion. We present Agentic Cloud Workflow Engineering, an agentic AI framework that transforms natural-language agentic cloud-engineering tasks into validated code repositories and verified operational cloud deployments for automating cloud-based agentic workflows. The framework separates three complementary concerns: graph engineering specifies long-horizon workflow progression and verification-dependent transitions; loop engineering provides bounded diagnosis, repair or re-planning, retry, and re-verification; and agent harness engineering enforces zero-trust execution through identity, authorization, policy-scoped capabilities, isolation, and runtime safeguards. Workflow progression and completion require machine-checkable repository, deployment, and runtime evidence, with recovery constrained by explicit operational bounds and termination criteria. We instantiate the framework on Google Cloud and evaluate repository completeness, controlled execution, evidence-gated progression, operational deployment, and bounded recovery. Experimental results show that executions terminate with either a verified operational cloud deployment or an auditable terminal failure under bounded recovery. The framework provides a unified engineering architecture for cloud-based workflows spanning Agentic DevOps, Agentic CloudOps, Agentic SRE/AIOps, Agentic SecOps, Agentic DataOps, Agentic MLOps/LLMOps, AgentOps, Agentic RAG/GraphRAG, and related cloud-engineering domains.
1 Introduction
Agentic Cloud Workflow Engineering unifies graph engineering, bounded recovery loops, and a zero-trust agent harness for cloud workflows across multiple operational domains. It transforms natural-language tasks into validated repositories and verified deployments, with completion gated by machine-checkable evidence.
- The framework spans cloud-engineering domains including DevOps, CloudOps, SRE/AIOps, SecOps, DataOps, MLOps/LLMOps, AgentOps, and Agentic RAG/GraphRAG.
- Natural-language tasks become validated code repositories and verified cloud deployments, with completion gated by repository, deployment, and runtime evidence.
- The architecture coordinates repository generation, review, deployment, verification, monitoring, and recovery through graph-structured workflows.Verification failures or adverse runtime evidence activate diagnosis, repair or re-planning, retry, and re-verification.
- Graph engineering controls long-horizon workflow progression, loop engineering bounds diagnosis and recovery, and the agent harness constrains execution through zero-trust controls.The harness includes scoped tool access, identity, authorization, policy enforcement, isolation, observability, audit, and evidence capture.
- The paper organizes the framework around graph engineering, a zero-trust execution boundary, and evidence-gated workflow progression.
2 Problem Formulation
The framework models agentic cloud engineering as transforming a natural-language task into a validated repository, verified deployment, and retained verification evidence. Execution combines graph progression, bounded recovery, and constrained agent execution, terminating only with verified success or auditable failure.
- The framework represents a task q as (R∗, D∗, Z∗) = F(q), producing a code repository, cloud deployment, and verification evidence.
- Graph engineering specifies workflow progression, loop engineering manages bounded diagnosis and recovery, and agent harness engineering constrains execution with identity, authorization, policy, isolation, state, and observability controls.
- Successful completion requires RepoValid, DeployVerified, and RuntimeVerified to hold together using retained evidence.
- When verification remains unsatisfied after applicable recovery bounds are exhausted, execution terminates in an auditable failure state.
3 Overall Framework
The Google Cloud realization binds each task to identity, tenant, scope, approval, and policy context before execution. A Graph Orchestrator coordinates specialized agents, while failed verification activates bounded recovery and requires fresh evidence before progression resumes.
- Each task is bound to identity, tenant, scope, approval, and policy context before workflow execution.
- The Graph Orchestrator coordinates repository generation, review, execution and deployment, verification, and runtime monitoring agents using ADK, with A2A supporting delegation and task exchange.
- Failed verification or adverse runtime evidence activates bounded diagnosis, repair or re-planning, retry, and re-verification through the orchestrator.
- Forward progression requires fresh evidence, and exhausted recovery limits produce an auditable failure state when required verification remains unsatisfied.
4 Experiments
The experiments evaluate the framework on a 140-task, 14-domain benchmark across four models and controlled execution conditions. Results show model-dependent verified completion, while graph control, evidence gating, and bounded recovery support end-to-end verified task completion.
- 4.2 Benchmark Suite: The benchmark contains 140 end-to-end natural-language tasks across 14 agentic cloud-engineering domains, with 10 tasks per domain.Each task requires repository generation and validation, cloud deployment, and operational-runtime verification.
- 4.3 Experimental Setup: Four models are evaluated independently using fixed provider-default generation configurations without task-specific tuning.
- 4.3 Experimental Setup: Each execution is bounded by 20 recovery attempts, 120 minutes, 10,000,000 cumulative model tokens, and 500 tool calls.Cost, privilege, and blast-radius limits are fixed per benchmark task.
- 4.5 Results and Analysis: VTCR rises from 56.4% for Gemini 2.5 Flash-Lite and 68.6% for Gemini 2.5 Flash to 82.1% for Gemini 2.5 Pro and 95.0% for GPT-5.6 Sol.The corresponding verified-completion counts are 79, 96, 115, and 133 out of 140 nominal executions.
- 4.5 Results and Analysis: The framework enables end-to-end verified task completion through graph-controlled execution, evidence-gated verification, and bounded recovery.The reported result supports decoupling model-independent verification enforcement from model-dependent recovery capability.
5 Conclusion
Agentic Cloud Workflow Engineering combines graph-controlled progression, bounded recovery loops, and zero-trust harness controls to transform natural-language tasks into verified cloud deployments. Completion requires machine-checkable evidence; otherwise, bounded recovery ends in an auditable failure state.
- The framework transforms natural-language agentic cloud-engineering tasks into validated repositories and verified operational cloud deployments through graph-controlled, bounded, evidence-gated execution.
- Graph engineering governs long-horizon progression and verification-dependent transitions, while loop engineering provides bounded diagnosis, repair or re-planning, retry, and re-verification.
- Agent harness engineering constrains external actions through authorization, policy-scoped capabilities, isolated execution, state, runtime security, observability, and evidence controls.
- Successful completion requires machine-checkable repository, deployment, and runtime evidence; exhausted recovery bounds produce an auditable failure state.
- A Google Cloud realization evaluates verified completion, controlled progression and recovery, authorization and policy enforcement, and bounded termination across heterogeneous tasks.
6 Technical Appendix
The evaluation shows that evidence-gated progression, authorization, policy enforcement, and bounded termination are consistently enforced, while recovery and verified completion vary by model and domain. Ablations further show that bounded recovery is important for completion, and the framework is currently evaluated under constrained Google Cloud conditions.
- Additional Results: 420/420 (100.0%) verification-perturbation executions preserved evidence-gated progression across models.No execution crossed a verification-dependent transition or reached terminal completion while the corresponding repository, deployment, or runtime condition was unsatisfied.
- Additional Results: 214, 278, 321, and 391 successful recoveries produced RSR values of 51.0%, 66.2%, 76.4%, and 93.1% across the four models.Recovery success decreased consistently from repository to deployment to runtime perturbations; for GPT-5.6 Sol, the corresponding rates were 95.7%, 93.6%, and 90.0%.
- Additional Results: All models achieved UCDR of 140/140 (100.0%) and ACPR of 139/140 (99.3%).The results indicate that unauthorized or out-of-scope requests were blocked while nearly all matched authorized requests were permitted.
- Additional Results: All models achieved BTR of 140/140 (100.0%) for recovery-budget-exhaustion executions.No execution progressed beyond an unsatisfied verification condition or continued recovery after configured bounds were exhausted.
- Additional Results: Across 14 domains, EGER, UCDR, and BTR remained 100.0% for both average and lowest-domain values, while VTCR and RSR varied by model and domain.GPT-5.6 Sol achieved the highest cross-domain VTCR average of 95.0% and RSR average of 93.1%.
- Ablation Study: Disabling bounded recovery reduced VTCR from 133/140 (95.0%) to 18/140 (12.9%), an 82.1 percentage-point decrease.Replacing machine-checkable progression with model-determined progression reduced EGER from 420/420 (100.0%) to 416/420 (99.0%), allowing four invalid transitions.
- Limitations and Future Work: The evaluation is limited to Google Cloud, controlled failures, fixed recovery budgets, predefined verification predicates, and limited adversarial testing.Future work includes multi-cloud validation, production incidents, adaptive budgets, richer verification, and stronger adversarial testing.
- Engineering Abstractions: The framework separates graph engineering, loop engineering, and agent harness engineering into complementary workflow concerns.Graph engineering controls progression, loop engineering handles bounded diagnosis and recovery, and the harness controls capabilities, permissions, and execution environments.