Zero-trust control for autonomous infrastructure work
Warden
A governed control plane that puts policy, spend ceilings, teardown deadlines, identity, human approvals, DLP, and tamper-evident evidence between an AI agent and cloud infrastructure.
- Agent runtime
- Google ADK fleet with Gemini model selection
- Control plane
- FastAPI dashboard, CLI, and desktop launcher
- Durability
- Firestore workflows and OIDC-authenticated Cloud Tasks
- Evidence
- SHA-256 audit chain, traces, and cloud posture snapshots
The project
What it does
Warden is designed for the uncomfortable gap between an agent proposing infrastructure work and a provider actually doing it. Every tool call passes through a runner-level policy plugin before execution. Budget, placement, TTL, identity, approval quorum, DLP, and global capacity are enforcement inputs, not suggestions in a prompt.
High-risk work can park as a durable workflow, wait for a verified human decision, and resume asynchronously. Approved authority is bound to a specific envelope and consumed transactionally. Each decision and outcome is sealed into an audit chain so an operator can verify not only what ran, but also what was denied, approved, cleaned up, or left uncertain.
Built around
Product principles
Policy before provider
The ADK interception layer can deny or park a tool call before the underlying cloud adapter runs.
Durable human approval
Workflows survive the wait for an OIDC-identified, single-use, role-appropriate human grant.
Bounded missions
Cost, TTL, placement, action count, instance count, and cleanup live inside an immutable execution envelope.
Evidence that can be checked
Hash chaining, durable checkpoints, traces, and cleanup receipts expose tampering and missing outcomes.
System architecture
How the system moves
Warden separates intent, governance, execution, and evidence. Gemini and the ADK fleet may plan and select tools, but the policy plugin, workflow store, and provider adapters hold the authority to proceed.
Governed fleet execution
-
01 · Operator
Dashboard, CLI, or desktop
A verified person defines an objective, policy profile, and bounded mission envelope.
-
02 · Fleet
Gemini and Google ADK
A lead agent delegates work to registered specialists and proposes typed tool calls.
-
03 · Gate
Warden policy plugin
Identity, cost, TTL, placement, capacity, DLP, and approval rules are evaluated before execution.
-
04 · Workflow
Firestore and Cloud Tasks
Calls that need sign-off park durably, gather quorum, and resume with authenticated tasks.
-
05 · Provider
Cloud tools and Manifold bridge
Only approved, in-envelope actions reach Google Cloud or another controlled compute backend.
-
06 · Evidence
Ledger, traces, and receipts
Results, denials, spend, cleanup, and uncertainty are sealed into verifiable operator evidence.
Approval does not override a hard policy denial. It grants one bounded action or mission envelope, and the execution path still enforces spend, TTL, placement, DLP, and cleanup rules.
Keep exploring