01 — enoki — the pitch
Agentic ChatOps for Google Cloud.
enoki turns a Slack message into a typed, identity-aware GCP action — reads run instantly under your own IAM, and anything consequential waits for a one-click approval.
02 — The problem
Cloud ops lives in too many places.
Answering "what is running, and who can touch it?" means leaving the thread the team already works in for consoles, CLIs, and runbooks.
- —Every operator needs console access and a configured CLI.
- —Shared automation drifts toward god-mode service accounts.
03 — The idea
Speak to your cloud, as yourself.
enoki is a Slack agent that runs Google Cloud in plain language. Every call executes under the asker’s own Google identity — their IAM is the only boundary.
- —No shared bot admin, no standing keys.
- —Gemini on Vertex AI proposes; it never authorizes.
04 — Two identities
Inference and access never mix.
The model runs as enoki’s own service account and only ever calls Vertex. Every data action runs under the user’s OAuth identity, refreshed at the point of use.
- —A compromised bot cannot read your data.
- —Auth fails closed at Google’s IAM — not a check we could get wrong.
05 — The control
The model proposes; you approve.
Every capability is an enumerated, validated tool — no run_gcloud, no raw SQL. Consequential writes pause for a one-click Approve / Deny in the thread.
- —Reads run immediately; writes wait for a human.
- —Approvals are per-call, single-use, and audited.
06 — The coverage
One thread, the whole platform.
BigQuery, Cloud Storage, Compute, Pub/Sub, Cloud SQL, Monitoring, Logging, plus IAM and billing reads — thirty-plus typed tools, and growing.
- —List, inspect, and query across every project you hold.
- —Create, resize, snapshot, and tear down — always approved.
07 — Private by construction
Zero-copy, fully audited.
enoki holds no Slack messages or cloud data outside your own project. Every GCP action is written to a structured, append-only audit trail.
- —Conversation context is short-lived and TTL-reaped.
- —Who, which tool, read-or-write, args, result — including denials.
08 — Where it runs
It lives in your cloud, not ours.
Deploy enoki to Cloud Run in your own GCP project. Shared state is Firestore, secrets sit in Secret Manager, and the runtime service account holds no data-plane access at all.
- —Scales horizontally; an approval resolves on any instance.
- —Nothing leaves your project — inference, data, and audit all stay in.
09 — The ask
Bring your cloud into the conversation.
enoki is ready to install to a Slack workspace and connect to Google Cloud. Add it, link your identity, and operate GCP from the thread you are already in.