Vectra Governance

An autonomous cloud remediation engine leveraging Vertex AI and FastAPI to execute deterministic O.D.E.R loops, inspecting system telemetry and executing automated risk-mitigation guardrails.

Comment

What it does

Vectra Governance is an autonomous, zero-trust cloud remediation engine engineered to maintain system integrity and execute real-time incident response across enterprise infrastructure.

Granting un-gated AI agents direct root access to production systems introduces severe security vulnerabilities. Vectra solves this by enforcing a zero-trust boundary—decoupling diagnostic reasoning from execution authority.

At the core of Vectra is the O.D.E.R (Observe, Decide, Execute, Reflect) execution framework:

  • Observe: Ingests high-concurrency telemetry streams, system alerts, and infrastructure webhooks (e.g., 45,000 RPS stress floods) at the edge.

  • Decide: Validates request signatures via HMAC SHA-256 to drop unauthorized payloads immediately (HTTP 403), protecting compute resources and token budgets before generative inference runs.

  • Execute: Routes benign, low-risk anomalies to Vertex AI (Gemini 3.7 Flash) for root-cause diagnosis. If proposed actions touch high-risk assets (such as production root IAM policies), execution automatically halts behind a Human-in-the-Loop (HITL) cryptographic state lock.

  • Reflect: Verifies state integrity, validates operator cryptographic signatures, and outputs structured, audit-ready event trails directly to Google Cloud Logging.

How we built it

Vectra Governance was engineered from the ground up prioritizing low-latency backend execution, deterministic security boundaries, and cloud-native scalability:

  • Core Runtime & Edge Gateway: Built with Python 3.11 and FastAPI to handle high-concurrency asynchronous payload ingestion and constant-time HMAC SHA-256 signature verification.

  • AI Remediation Engine: Integrated the official Google GenAI SDK targeting Vertex AI (gemini-3.7-flash) to perform rapid multi-layer root-cause analysis and emit structured JSON mitigation payloads.

  • Container Architecture: Optimized using lightweight Docker (python:3.11-slim) base images to maintain a minimal surface area and reproducible runtime environments.

  • Cloud Infrastructure: Deployed natively to Google Cloud Run (us-central1 under project ginseng-3c019) via gcloud CLI workflows, leveraging GCP IAM service credentials for secure execution.

Challenges we ran into

  • Mobile-Native SRE Constraints: Developing and deploying an enterprise-grade cloud AI system directly from an Android terminal (Termux) presented severe local compilation constraints when building native C++ SDK dependencies. We resolved this by shifting all build steps remotely to Google Cloud Build, managing container registries via gcloud, and configuring IAM permissions (run.googleapis.com, aiplatform.googleapis.com) purely through targeted CLI commands.

  • Cryptographic Boundary Precision: Preventing timing side-channel attacks and payload serialization mismatches between incoming webhook bodies and header signatures required implementing strict constant-time digest comparison (hmac.compare_digest) before JSON parsing occurred.

Accomplishments that we're proud of

  • Zero-Token Waste Edge Defense: Dropping un-authenticated or malicious attack vectors at the perimeter (HTTP 403) before invoking Vertex AI—saving compute resources and preserving token quotas.

  • Deterministic HITL Lock Engine: Successfully building a cryptographic gate that automatically freezes execution threads targeting critical assets until an SRE operator provides a signed HMAC approval token.

  • End-to-End Mobile-to-Cloud CI/CD: Engineering, containerizing, and deploying a serverless zero-trust governance platform directly from a terminal environment to production Cloud Run infrastructure.

What we learned

Building Vectra Governance proved that determinism must supervise non-determinism.

While generative models like Gemini 3.7 Flash excel at isolating complex system failure modes under extreme load, high-risk infrastructure changes must remain bound by hard cryptographic policies. Decoupling diagnostic reasoning from execution authorization allows teams to harness AI velocity without sacrificing security.

What's next for Vectra Governance

  • Real-Time Telemetry Streaming: Integrating Google Cloud Pub/Sub pipelines for sub-second incident detection across distributed microservices.

  • Semantic Threat Ontologies: Mapping diagnostic outputs directly to OCSF and MITRE ATT&CK open frameworks for standardized compliance reporting during the Diagnose phase.

  • Dynamic Mesh Topology Engine: Building live graph synchronization to track real-time Cloud Run scaling, container lifecycle states, and internal service meshes.

  • Sandboxed Remediation Testing: Expanding multi-agent orchestration to dry-run and verify remediation patches in isolated sandbox environments prior to production rollout.

Built With

  • ai-governance
  • cryptography
  • devops
  • docker
  • fastapi
  • gemini-api
  • google-cloud
  • google-cloud-build
  • google-cloud-logging
  • google-cloud-run
  • google-genai-sdk
  • hitl
  • hmac-sha256
  • python
  • security
  • termux
  • vertex-ai
  • zero-trust
Share this project:

Updates

Submission history