An SRE agent that cannot mutate prod without asking

Once you run multi-tenant agent workloads on Cloud Run and Cloud Tasks, the on-call surface expands: stuck state machines, stale held slots, voice provider timeouts, migrations that left a tenant mid-flight. Humans can chase that. Humans also sleep. I wanted an agent that investigates the way a careful SRE would, and never heals the way a reckless one would.

The architecture is deliberately boring. Scoped MCP access to GCP logging, Cloud Run, Cloud Tasks, GitHub, the voice provider, and the database through a read-only proxy. The agent detects anomalies, pulls logs plus recent commits plus DB state, and returns a likely cause with a confidence score. Known failure modes get a proposed heal: reaper for stuck states, release stale holds, unstick a referral. Unknowns get a drafted postmortem, not a write.

The product is the safety posture. Read-only by default. No production mutation without an explicit human confirmation gate. Every proposed action is attributable. Every confirmed heal becomes a playbook the next incident can reuse. That is the same discipline banks use for operational risk, applied to agent runtimes.

People ask whether an ops agent is safe. Wrong question. Ask whether its blast radius is bounded by something harder than a prompt. Ours is: network-scoped credentials, read-only DB path, confirmation on every mutate. Useful agents are permissioned systems. Everything else is a demo with root.

The through-line with the rest of my work is the same thesis: reliability is the product. Evals catch silent agent failures. Confirmation gates catch eager ones. Both are harness engineering wearing different clothes.