Google's SRE team published a long paper on running AI agents in production — read it here. The first few pages are skim-and-close. The middle is sharp.

The five things worth keeping

  • Autonomy is a gated dial, not a setting. L0–L4. Ship at L2 (act with approval), earn L3 by passing evals. Risk score climbs, dial drops back automatically.
  • Evals are the work; the agent is the cherry. Bronze (auto-generated), Silver (calibrated), Gold (human-verified). LLM-as-judge plus deterministic scoring. Run nightly, not once before launch.
  • Split the brain from the hands. The reasoning LLM has no credentials. A separate actuation agent owns dry-run, policy checks, and the red button. Catastrophic action gets refused at the architecture layer, not the prompt.
  • The angry tweet is a signal. Complaint streams — social, support tickets — feed the outage-detection stack alongside metrics. Novel failures don't match old alerts.
  • Code review doesn't scale to 4× output. Review design intent and policy, not lines. And keep the code-gen AI isolated from the test-writing AI — otherwise the same model writes the bug and the test that confirms it's fine.

What we'd steal first

  1. A Gold eval set and a nightly eval job. Without it, you're shipping vibes.
  2. An actuation layer with dry-run, policy, and a red button. Architectural, not promptural.
  3. A complaint-stream signal in observability. Catches the class of failure your dashboards don't measure.
The agent isn't the product. The eval set, the actuation plane, and the observability around it are. The agent is the part you swap out next quarter when the next model lands.

Kirin builds and operates AI features for product teams who can't afford to ship vibes.