Ismail Sajid

Building production multi-agent systems | LangGraph + MCP + Orchestration | Open-sourcing the "Kubernetes of AI Agents" | Helping teams go from demo → reliable

[Ismail Sajid @flow_comm]

I spent months building an open-source "Kubernetes for AI Agents."

Solo engineer. Karachi, Pakistan.

Every claim is verified against running code. No aspirational PowerPoint demos.

Here's what 10 services, 25 concurrent agents, and 0 CVEs look like ↓

https://t.co/0Olp2HjCcU

[Ismail Sajid @flow_comm]

@anah_sahh Yes

[Ismail Sajid @flow_comm]

Full open-source architecture, CRD manifests & benchmarks: https://t.co/vyvnJ4cAEP

[Ismail Sajid @flow_comm]

How we define an autonomous agent on Kubernetes without letting it run wild:

Instead of hardcoding prompt loops in Python scripts, we declare agents as native Kubernetes CRDs (AgentDefinition).

A production agent spec must enforce boundaries at admission time:

1. Max Execution Budget: Hard limit on tool hops & token ceilings. If a loop goes rogue, the pod terminates before burning $1,000.
2. Tool Admission: Explicit RBAC on tool scopes. An agent cannot call external write APIs unless cryptographically signed.
3. Sandbox Runtime: Injects gVisor (runsc) at container startup to isolate bash syscalls.
4. Retry Policy: Maps transient 429s to Temporal backoff activities instead of dropping memory state.

Infrastructure belongs in declarative manifests, not hidden inside application logic.

[Ismail Sajid @flow_comm]

Automating sandbox creation for terminal agents without strict kernel boundaries leads to noisy-neighbor issues and breakout risks.
In our K8s control plane, we spin up ephemeral gVisor pods per task run so terminal agents can execute bash freely without compromising cluster isolation.
Great research!

[Ismail Sajid @flow_comm]

@o_kwasniewski Agent verification cannot happen in-memory post-run; it must be verified at the runtime boundary before tools commit side effects.

We built declarative verification loops and semantic drift monitors directly into our K8s control plane: https://t.co/vyvnJ4cAEP

Dropped you a DM!

[Ismail Sajid @flow_comm]

Crucial checklist for PE deal teams.
Point [1] model dependency is why runtime level routing matters, hardcoding proprietary APIs kills valuation if the model shifts.
In our K8s control plane, we decoupled the reasoning engine using multi-model abstraction proxies with failover budgets.
https://t.co/cZi52j2cbk

[Ismail Sajid @flow_comm]

Shared agent memory breaks down quickly once tools execute concurrently without distributed locking.
We solved this in our K8s control plane using Redis Sentinel for hot session state, pgvector for long-term semantic memory, and Temporal to serialize state transitions across worker pods.
Solid work on Waku Agent!

[Ismail Sajid @flow_comm]

Exactly. Giving an agent access to bash or database writes inside standard Docker containers means one prompt injection can mutate host paths.
We intercept syscalls with gVisor and apply fail-closed OPA admission policies before the tool even executes.
Are you running into sandboxing limits on server deployments right now?

[Ismail Sajid @flow_comm]

The fundamental mental shift AI teams miss:

Stop treating AI agents like stateless microservices.
Start treating them the way Kubernetes treats containers: as untrusted tenant workloads.

If an agent has tool access, bash execution, and external write permissions, it must be:
• Authenticated & Authorized (OPA / Rego policy admission)
• Isolated (gVisor kernel sandboxing)
• Metered (Hard token quotas & spend caps)
• Observed (OTel semantic traces & drift metrics)

This is the 5-plane runtime architecture we open-sourced in E-GAOP (The Kubernetes of AI Agents):

1. Control Plane: Temporal workflow engine for durable state + ReAct retry DLQs
2. Execution Plane: Multi-model router + ephemeral gVisor container runtimes
3. Data Plane: PostgreSQL 15 (pgvector) + Redis 7 Sentinel HA caching
4. Policy Plane: Fail-closed admission control + namespace isolation
5. Observability Plane: Prometheus, Tempo traces & Loki logs

10 microservices. 812 tests. 0 CVEs.
Built to make multi-turn autonomous runs crash-proof in production.

Full architecture & code:
https://t.co/cZi52j2cbk

[Ismail Sajid @flow_comm]

If your production agents are struggling with dropped context on 3rd-party API timeouts or unshielded tool executions, drop a comment below or DM me, happy to share how we wired the Temporal state checkpointing and gVisor isolation.

[Ismail Sajid @flow_comm]

@hotfixjobs An Enterprise Agentic AI Engineer. I design the layer most teams skip: the control plane that makes LLM agents behave like production software; authenticated, isolated, metered, observed, and governed.
https://t.co/vyvnJ4cAEP

[Ismail Sajid @flow_comm]

@hotfixjobs Interested with this POC
https://t.co/SxiIGj83Jy

[Ismail Sajid @flow_comm]

@hotfixjobs Interested with this POC
https://t.co/vyvnJ4cAEP

[Ismail Sajid @flow_comm]

The paper's separation of 'process failures' (loops/step budgets) from 'content failures' is fundamental.
The harness must own execution continuity.
We built The Kubernetes of AI Agents on this exact principle: handling retries, budgets, and state recovery at the infrastructure layer via Temporal, leaving the model to focus purely on reasoning.

[Ismail Sajid @flow_comm]

Watching runs manually to kill them at minute 6 is an operational nightmare.
In our K8s control plane, we wired Prometheus metric hooks that automatically evaluate semantic drift and hard kill/pause runs exceeding cost thresholds before the bill spikes.
Open-source: https://t.co/cZi52j2cbk

[Ismail Sajid @flow_comm]

@armalo_ai @undefinedKi A simple iteration cap in code still leaks tokens if the loop doesn't have semantic circuit breakers.
We enforce both: hard iteration ceilings via Kubernetes CRD budgets and pre-execution policy checks using OPA in our control plane. https://t.co/vyvnJ4cAEP

[Ismail Sajid @flow_comm]

Every AI agent looks magical in a demo.

Then you deploy it to real users, and production reality hits:

• Task runs for 15 minutes, hits a 3rd-party API timeout on step 12, drops full context memory, and crashes.

• A sub-agent gets trapped in a recursive hallucination loop, burning $4,000 in model credits before morning.

• Your CISO flags security: the agent executes unshielded bash commands directly on the host server.

Most teams think they have a "prompting problem."
They don't. They have an infrastructure problem.

AI agents aren't stateless microservices. They are long-running, non-deterministic state machines that need their own runtime control plane.

That is why I spent months architecting E-GAOP (The Kubernetes of AI Agents):

1. Control Plane: Declarative CRDs (AgentDefinition, AgentTask, AgentWorkflow) separating business logic from infra limits.

2. Durable State: Backed by Temporal event stores so crashed steps resume without re-running earlier tool calls or wasting tokens.

3. Kernel Isolation: gVisor container sandboxes + OPA policies to block prompt injections and rogue system commands.

4. Semantic Telemetry: Real-time drift detection and token budgets to prevent runaway spend.

10 microservices. 812 tests. 0 aspirational slides. Built for engineers moving beyond fragile scripts.

Open source & architecture:
https://t.co/gdf6GIiRc7

[Ismail Sajid @flow_comm]

Most agent demos look great until:
• An agent calls the same tool in a loop until the bill dies
• It drops full context state on a single API timeout
• It fails silently with zero execution trace
I’m open-sourcing the orchestration patterns to fix this in The-Kubernetes-of-AI-Agents:
1. Deterministic state recovery via Temporal
2. Kernel-level isolation using gVisor sandboxing
3. Hard token limits via declarative CRDs
Not building hype, just solving the infrastructure failure modes that break agents in production.
Repo: https://t.co/gdf6GIiRc7