Cloud Agent Lab

Multi-agent system

Specialized agents, one shared goal

Each agent has one job, a defined input and output, and access only to the tools that job needs. They pass structured JSON to each other, and every output is validated before the next agent uses it.

Diagram: the Requirements Analyst passes requirements to the Planner, which passes a task plan to the Deployer, which makes AWS tool calls. The Verifier records check evidence, and the Diagnoser finds root causes and sends a fix back to the Deployer after human approval.

The agents

Requirements Analyst

Working

Reads a plain-language request and returns structured requirements, each with a priority, plus service dependencies, risks and open questions.

Output: requirements.json

Planner

In development

Turns the requirements into an ordered list of deployment tasks, each mapped to an approved tool and its arguments.

Output: task plan

Deployer

In development

Executes planned tasks through an allowlist of deployment tools: certificate, bucket, CloudFront and DNS steps. Changes that could break the site wait for human approval.

Tools: AWS SDK for Python

Verifier

In development

Tests the live site: HTTPS, the HTTP redirect, certificate names, every page, CloudFront delivery and denied direct S3 access. Records status codes and headers as evidence.

Output: check results

Diagnoser

In development

Reads failed checks with the current configuration, identifies the likely root cause, and proposes a specific fix for a person to approve.

Output: proposed corrective action

Rules every agent follows

  • Agents call approved tool functions with validated arguments. They never run shell commands written by a model.
  • Creating, deleting or changing permissions on cloud resources requires human approval.
  • Only S3, CloudFront, Route 53 and Certificate Manager may be used.
  • Prompts, tool calls, results and validation outcomes are logged, with secrets removed.
  • No agent's claim of success is accepted without an independent check.