By Pravin Nagare, Senior Software Engineer, Roku Inc
In 2027, I expect the difficult part of putting AI agents into production to move deeper into the cloud infrastructure they use. An agent that can choose a tool and send a request is useful. Giving it permission to change a subscription, provision resources or update an account introduces a different engineering problem. The surrounding systems have to distinguish an intended action from an accidental repeat, limit what the agent can change and explain what happened when a task stops halfway through.
My prediction is that this will bring some familiar distributed systems problems into product planning much earlier. Teams will discover that a convincing demonstration says little about how a workflow behaves after a timeout, a permission change or an unexpected bill. Four changes seem likely to follow.
APIs will need to expose the state of the work
I expect more cloud APIs intended for agent use to separate accepting work from reporting its outcome. A request acknowledgement is often insufficient for a caller that must decide what to do next. The caller needs a durable way to find out whether the operation is pending, complete or safe to attempt again.
Consider an agent asked to change a customer’s subscription. If the connection drops after the change is accepted, the agent cannot safely infer that nothing happened. Repeating the action could create an unwanted second operation. A stable operation identifier and a way to retrieve the result give the workflow something concrete to check.
These techniques already exist. My prediction is that buyers will ask for them more explicitly when evaluating services for automated workflows. Documentation about ambiguous outcomes will become part of the integration decision, alongside the list of available features.
Permission design will become a product decision
In 2027, I expect teams to spend more time defining the authority attached to an individual task. Broad credentials are convenient during development. They become harder to justify when software can choose a sequence of actions without a person checking each step.
A workflow that investigates a billing problem may need to read an account and propose a correction. That does not automatically justify permission to issue a refund. The boundary should be enforced by the service carrying out the action, with approval required where the consequences warrant it.
An agent’s authority should be narrower than its ability to make a plan.
This will require product and infrastructure teams to work through uncomfortable details together. They will have to decide which actions can proceed automatically, how much money or capacity a task can commit and when permission expires. A prompt telling an agent to be careful cannot replace those decisions.
Cloud cost reviews will follow the whole task
I also expect cost discussions to move beyond the price of an individual model call. A seemingly simple task can involve repeated searches, database reads, tool calls and attempts to recover from errors. The useful accounting unit will be the completed business task, including the work that failed along the way.
That changes how teams compare implementations. A cheaper model may need more attempts to finish a task. A more capable model may still be expensive if the workflow fetches the same information repeatedly or continues after its result is no longer useful.
I expect task budgets to become an ordinary production control. Teams will set limits on elapsed time, tool calls and resource consumption, then define what happens when a limit is reached. Some tasks should stop and return partial progress. Others should go to a person for review. Continuing indefinitely should require a deliberate decision.
Testing will include unfinished work
Finally, I expect production evaluations to put more weight on interrupted workflows. Teams will test what happens when access is revoked midway through a task, a dependency becomes unavailable or only some requested changes succeed.
The test result should show which actions actually took effect and what remains unresolved. A fluent explanation from the agent is insufficient evidence. The underlying services need records that let operators reconstruct the outcome and decide what can safely continue.
By the end of 2027, I expect these operational questions to carry more weight in decisions about which agent workflows reach production. The teams that answer them early will have a clearer basis for giving automation more responsibility.
##
ABOUT THE AUTHOR
Pravin Nagare is a Senior Software Engineer at Roku Inc, where he works on commerce SDKs, secure identity and subscription workflows across connected devices and cloud services. His background spans cloud integration, billing reliability, compiler optimization and infrastructure automation. His interests include the secure and reliable use of AI in cloud systems, particularly how AI agents interact with infrastructure, permissions and automated workflows.
