Warden

• 

  Step 1: Warden opens with a governed fleet dashboard showing live missions, spend limits, approvals, policy simulation, and audit evidence.

• 

  Step 2: Policy Lab previews the requested GPU launch, calculates $0.85, and confirms simulation changes neither provider state nor policy.

• 

  Step 3: The operator creates a mission envelope with one action, a five-minute TTL, approved placement, and an $0.08 spend ceiling.

• 

  Step 4: Warden runs the approved real Google VM inside the signed envelope while tracking cost, progress, TTL, and cleanup status.

• 

  Step 5: A prompt injection orders the agent to ignore policy and delete production; Warden evaluates the requested tool call instead.

• 

  Step 6: A destructive terminate request is parked for two distinct senior approvals, while the cryptographic audit trail records it.

• 

  Step 7: Warden collects cloud asset, security, finance, and workflow evidence into a sealed snapshot with verified cleanup.

• 

  Step 8: Read-only replay verifies the ledger and re-evaluates recorded evidence without changing state or invoking a provider.

• 

  Step 9: Red-team tests six attack paths: budget abuse, privilege escalation, DLP, placement, teardown, and prompt injection.

Inspiration

Autonomous agents can move faster than human operators, but cloud infrastructure gives mistakes a real cost: overspend, unsafe teardown, data leakage, and actions that are difficult to reconstruct. Warden was built to give agents useful freedom inside enforceable boundaries.

What it does

Warden is a zero-trust governance control plane for Gemini-powered agent fleets. Every proposed action passes through policy before it reaches a provider. Warden enforces approved regions and machine types, authoritative spend ceilings, mandatory resource lifetimes, mission-scoped approval envelopes, role-aware human approval, and multi-party quorum for sensitive operations.

The operator dashboard combines a fleet terminal, approval inbox, live budget and TTL status, policy simulation, historical replay, cloud-security findings, and a cryptographically chained audit trail. In live mode, durable workflow state and approvals are stored in Firestore, while Cloud Tasks can resume parked workflows after approval.

How we built it

The fleet uses Google ADK and the Google GenAI SDK with Gemini 3.5 Flash as the primary model. A runner-level ADK plugin intercepts tool calls before execution. Pure policy evaluation, a trusted cloud rate card, transactional reservations, and single-use approval grants keep authority outside the model.

Cloud Run hosts the control plane. Firestore provides durable workflows, approvals, mission envelopes, reservations, memory, and ledger checkpoints. Optional Google Cloud integrations collect asset drift, Security Command Center findings, billing evidence, Model Armor results, and Cloud Trace telemetry.

Challenges

The hardest problem was making controls durable under retries and concurrency. An approval cannot become reusable authority, a provider timeout cannot silently release budget, and two operators must not accidentally cast the same quorum vote. We addressed these with idempotency keys, transactional reservations, distinct verified identities, expiring grants, and conservative accounting for unknown outcomes.

We also separated simulation from enforcement. Policy Lab and replay never call providers, while the enforcement path fails closed.

What we learned

Governed autonomy works best when policy is visible before approval and evidence is useful afterward. Solo builders need safe templates and clear spending limits; enterprises need identity hierarchy, quorum approvals, durable workflows, and immutable evidence. The same control plane can serve both when the underlying contracts stay explicit.

What's next

Next we will expand the bounded live GPU lifecycle into additional managed-cloud adapters, deepen production evidence from Cloud Run, Cloud Trace, and security posture sources, and preserve the same policy and approval boundaries as fleets scale.

Built With

• ai-agents
• ai-governance
• cloud-firestore
• cloud-run
• cloud-tasks
• css
• cybersecurity
• docker
• fastapi
• gemini
• google-agent-development-kit
• google-cloud
• google-genai
• html
• javascript
• multi-agent-system
• oidc
• pydantic
• pytest
• python
• yaml
• zero-trust