Agentic FinOps on Google Cloud: Automating Cloud Spend Accountability at Scale — How Does It Work in Production?

TL;DR: To bridge the gap between centralized cloud billing reports and actual engineering remediation, enterprise organizations are deploying Agentic FinOps architectures using the Agent Development Kit (ADK) and Gemini 2.5 Pro on Google Cloud. By transitioning from passive dashboards to autonomous agents that analyze BigQuery billing exports, identify idle resources, and generate ready-to-merge Terraform pull requests, organizations can systematically enforce cloud spend accountability at scale without disrupting agile delivery cycles.

What Google Cloud Shipped & The Enterprise Problem It Solves

In enterprise cloud environments, the primary bottleneck in FinOps is rarely a lack of data; it is a lack of engineering action. Traditional FinOps relies on centralized teams generating complex Looker dashboards or BigQuery reports, which are then handed off to product engineering teams. However, in agile environments characterized by continuous deployment and relentless delivery backlogs, optimization work rarely wins against the sprint. Delivery priorities consume available bandwidth, leaving cost optimization as an afterthought.

Google Cloud addresses this systemic friction through the integration of the Gemini Enterprise Agent Platform and the open-source Agent Development Kit (ADK). This combination allows organizations to build and deploy AI agents that automate the FinOps lifecycle. As demonstrated by Orange, the multinational telecom provider, scaling FinOps accountability across thousands of engineers requires moving beyond human-led "Clean Days." While Orange successfully utilized gamification and community building to achieve a high Net Promoter Score for their FinOps initiatives, reaching the broader organization necessitated the deployment of AI agents.

These agents solve three distinct enterprise problems:

1. The Awareness Gap: Insight agents push real-time, context-aware cost data directly into developer workflows (e.g., Slack, Jira, or IDEs), eliminating the need for engineers to context-switch to billing dashboards.
2. The Bandwidth Gap: Remediation agents analyze infrastructure state, identify quick wins (e.g., unattached persistent disks, over-provisioned Cloud SQL instances), and present them as ready-to-merge Infrastructure-as-Code (IaC) changes.
3. The Complexity Gap: Orchestration agents gather disparate data from Cloud Asset Inventory, Cloud Monitoring, and BigQuery Billing Exports, synthesizing it into actionable, plain-text recommendations.

By leveraging ADK 2.0's graph workflows, these agents operate with deterministic logic, ensuring that financial data is handled predictably while utilizing the adaptive reasoning capabilities of models like gemini-2.5-pro.

Real-World Use Cases: Where This Moves the Needle in the Field

When we inspect production topologies, the application of Agentic FinOps extends far beyond simple cost reporting. Here is how this architecture manifests in practical engineering scenarios:

1. High-Throughput Enterprise Workloads: Quota Boundary Isolation

• The Everyday Problem: During burst traffic events (e.g., flash sales in E-Commerce), auto-scaling services like Cloud Run or GKE can rapidly consume quotas, leading to P99 tail-latency spikes and unexpected, massive billing anomalies. Engineers often discover the cost overrun days later.
• How It Works in Practice: An ADK-based agent continuously monitors Cloud Monitoring metrics and Cloud Asset Inventory. When it detects a rapid acceleration in resource consumption approaching a predefined FinOps threshold, the agent uses gemini-2.5-pro to analyze the traffic pattern. It can then autonomously trigger a circuit-breaker mechanism or dynamically adjust concurrency limits via the Google Cloud API.
• The Tangible Impact: Prevents catastrophic cost overruns and isolates fault domains in real-time, ensuring unit economics (cost-per-1k-requests) remain stable even under extreme load.

2. Zero-Trust Governance & Fault Isolation: Least-Privilege IAM Enforcement

• The Everyday Problem: Over time, IAM roles become over-provisioned. Developers grant roles/editor to service accounts for speed, creating massive security vulnerabilities and potential for unauthorized resource spinning (crypto-mining).
• How It Works in Practice: Aligning with the Google Cloud Security Framework, a read-only agent analyzes Policy Intelligence and IAM Recommender logs. It identifies service accounts with excessive permissions, uses Gemini to draft a least-privilege custom role, and generates a Terraform PR to enforce the new boundary.
• The Tangible Impact: Systematically reduces the attack surface and enforces zero-trust principles without requiring a human security engineer to manually audit thousands of IAM bindings.

3. Production FinOps & Unit Economics: Automated Resource Rightsizing

• The Everyday Problem: Teams over-provision Cloud SQL or AlloyDB instances to avoid performance bottlenecks, resulting in massive compute waste during off-peak hours.
• How It Works in Practice: An orchestration agent queries the BigQuery Billing Export and correlates it with CPU/Memory utilization metrics from Cloud Monitoring. If an instance consistently runs below 20% utilization, the agent generates a detailed impact analysis and a script to downsize the instance during the next maintenance window.
• The Tangible Impact: Directly reduces monthly compute spend by converting theoretical rightsizing recommendations into executable engineering tasks.

Reference Architecture on Google Cloud

To implement a production-grade Agentic FinOps system, we must design an architecture that is secure, scalable, and deterministic. The following topology utilizes Cloud Scheduler for cron-based execution, Cloud Run as the scalable agent runtime, and Vertex AI for reasoning, all bounded by strict IAM and VPC Service Controls.

flowchart LR
    subgraph "Trigger & Orchestration"
        CS[Cloud Scheduler] -->|Cron Trigger| CR[Cloud Run: ADK Agent]
    end

    subgraph "Agentic Reasoning & Tools"
        CR <-->|ADK Graph Workflow| VAI[Vertex AI: Gemini 2.5 Pro]
        CR -->|Tool: Query Billing| BQ[(BigQuery: Billing Export)]
        CR -->|Tool: Query State| CAI[Cloud Asset Inventory]
        CR -->|Tool: Query Metrics| CM[Cloud Monitoring]
    end

    subgraph "Action & Remediation"
        CR -->|Generate PR| GH[GitHub / GitLab]
        CR -->|Alerting| SL[Slack / Jira]
    end

    subgraph "Security Guardrails (VPC-SC)"
        direction TB
        VAI
        BQ
        CAI
        CM
    end

    classDef gcp fill:#e8f0fe,stroke:#4285f4,stroke-width:2px,color:#1a73e8;
    class CS,CR,VAI,BQ,CAI,CM gcp;

Architectural Components & Data Flow

1. Cloud Scheduler: Acts as the heartbeat of the system, triggering the FinOps agent on a defined schedule (e.g., daily or weekly).
2. Cloud Run (ADK Agent): Hosts the Python ADK 2.0 application. Cloud Run provides a serverless, scale-to-zero environment that is highly cost-effective for intermittent agent execution. The ADK framework manages the state, memory, and tool execution.
3. Vertex AI (Gemini 2.5 Pro): The reasoning engine. gemini-2.5-pro is utilized for its massive context window (capable of ingesting extensive billing logs) and its superior instruction-following capabilities for generating structured JSON or Terraform code.
4. BigQuery (Billing Export): The source of truth for cost data. The standard Google Cloud detailed billing export provides granular, resource-level cost attribution.
5. Cloud Asset Inventory & Cloud Monitoring: Provide the operational context. Cost data alone is insufficient; the agent must correlate spend with actual utilization (CPU, memory, network) to make accurate rightsizing recommendations.
6. VPC Service Controls (VPC-SC): Enforces a security perimeter around the data sources and the Vertex AI API, ensuring that sensitive financial and infrastructure data cannot be exfiltrated.

Step-by-Step Implementation

The following implementation demonstrates how to build a read-only FinOps agent using the Python ADK 2.0. This agent queries the BigQuery billing export, identifies the top spending projects, and uses gemini-2.5-pro to generate a summary report.

1. Prerequisites & IAM Configuration

Before deploying the code, ensure the Cloud Run service account has the principle of least privilege applied:

• roles/bigquery.dataViewer on the billing export dataset.
• roles/bigquery.jobUser to execute queries.
• roles/aiplatform.user to invoke Vertex AI models.

# Set variables
PROJECT_ID="your-production-project"
SA_NAME="finops-agent-sa"

# Create Service Account
gcloud iam service-accounts create $SA_NAME \
    --description="Service Account for Agentic FinOps" \
    --display-name="FinOps Agent SA"

# Grant BigQuery Data Viewer
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/bigquery.dataViewer"

# Grant Vertex AI User
gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/aiplatform.user"

2. Python ADK 2.0 Agent Code

This code utilizes the ADK to define a custom tool for querying BigQuery and an agent that leverages gemini-2.5-pro.

# main.py
import os
from google.cloud import bigquery
from google.adk import Agent
from google.adk.tools import tool

# Initialize BigQuery Client
bq_client = bigquery.Client()
BILLING_TABLE = os.environ.get("BILLING_TABLE_ID", "your-project.billing_dataset.gcp_billing_export_v1_XXXXXX")

@tool
def query_top_spending_services(days: int = 7) -> str:
    """
    Queries the Google Cloud BigQuery billing export to find the top 5 spending services 
    over the specified number of days.
    
    Args:
        days: The number of past days to analyze.
    """
    query = f"""
        SELECT
            service.description as service_name,
            SUM(cost) as total_cost
        FROM
            `{BILLING_TABLE}`
        WHERE
            usage_start_time >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL {days} DAY)
        GROUP BY
            1
        ORDER BY
            2 DESC
        LIMIT 5
    """
    
    try:
        query_job = bq_client.query(query)
        results = query_job.result()
        
        report = f"Top Spending Services (Last {days} days):\n"
        for row in results:
            report += f"- {row.service_name}: ${row.total_cost:.2f}\n"
        return report
    except Exception as e:
        return f"Error querying BigQuery: {str(e)}"

# Define the FinOps Agent using ADK 2.0 and Gemini 2.5 Pro
finops_agent = Agent(
    name="finops_optimizer",
    model="gemini-2.5-pro",
    instruction="""
    You are an expert Google Cloud FinOps Architect. Your job is to analyze cloud billing data 
    and provide actionable, engineering-focused recommendations. 
    When asked about costs, use the `query_top_spending_services` tool to get the data.
    Format your response in clear Markdown, highlighting the services and suggesting 
    standard GCP optimization strategies (e.g., committed use discounts, rightsizing) for the top spenders.
    """,
    tools=[query_top_spending_services],
)

def run_agent(request):
    """Cloud Run HTTP entry point."""
    # In a production scenario, this would parse a JSON payload or be triggered by Pub/Sub
    prompt = "What are our top spending services this week, and how can we optimize them?"
    
    # Execute the agent
    response = finops_agent.run(prompt)
    
    return {"status": "success", "recommendation": response.text}

3. Deployment to Cloud Run

Deploy the agent to Cloud Run, attaching the dedicated service account.

gcloud run deploy finops-agent-service \
    --source . \
    --region asia-southeast1 \
    --service-account "$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
    --set-env-vars="BILLING_TABLE_ID=your-project.billing_dataset.gcp_billing_export_v1_XXXXXX" \
    --allow-unauthenticated # Note: In production, require authentication and use Cloud Scheduler

Production Readiness: FinOps, Quotas & Security Guardrails

Transitioning an AI agent from a proof-of-concept to a production enterprise environment requires strict adherence to security frameworks and a clear understanding of the unit economics involved.

Security & Governance

As highlighted in the Google Cloud Security Framework, deploying Agentic AI requires a zero-trust approach.

• Read-Only vs. Execution Agents: Following Orange's methodology, organizations must start with read-only agents. The agent should only have permissions to query BigQuery and Cloud Asset Inventory. It should never have roles/owner or roles/compute.admin in its initial iteration. When moving to execution, the agent should generate Terraform code and open a Pull Request, requiring a human-in-the-loop (HITL) for approval, rather than executing infrastructure changes directly.
• VPC Service Controls: The Cloud Run service, BigQuery dataset, and Vertex AI endpoints must be enclosed within a VPC-SC perimeter. This prevents data exfiltration; even if the agent is compromised, it cannot send billing data to an external, unauthorized endpoint.

Quotas & Limits

Architects must account for the specific quotas of the underlying services:

• Vertex AI Token Limits: gemini-2.5-pro has specific quotas for Tokens Per Minute (TPM) and Requests Per Minute (RPM). If the agent is analyzing massive JSON dumps from Cloud Asset Inventory, it can quickly exhaust TPM quotas. Implement exponential backoff in the ADK tool calls and consider using Gemini's context caching for static infrastructure data.
• BigQuery Concurrency: While BigQuery is highly scalable, excessive concurrent queries from a fleet of agents can lead to slot contention. Ensure the agent uses targeted, optimized SQL queries rather than brute-force SELECT * operations.

📊 Production FinOps & TCO Simulation

To understand the financial impact of deploying this architecture, we must evaluate the cost of the agent itself versus the traditional method of manual dashboarding. The following table provides a deterministic calculation using official Google Cloud SKUs.

Note: The table below is generated dynamically via the verified FinOps SKU engine.

📊 Production FinOps & TCO Simulation: Agentic FinOps vs Traditional Dashboarding (Verified SKU Math)

Production Workload Assumptions (us-central1 / asia-southeast1):

• Option A relies on heavy BigQuery slot usage for daily manual dashboard refreshes across 100 engineering teams.
• Option B uses ADK 2.0 on Cloud Run to trigger targeted Gemini 2.5 Pro reasoning, reducing brute-force SQL queries.
• Cloud Run executes 500,000 vCPU-seconds and 1,000,000 GiB-seconds monthly for agent orchestration.
• Gemini 2.5 Pro processes 100 million input tokens and generates 20 million output tokens for remediation summaries.

Official Google Cloud SKU Pricing Sources (2026.09): cloud.google.com, cloud.google.com, cloud.google.com

While the raw operational cost of the Agentic FinOps architecture (Option B) is higher than passive dashboarding (Option A), this calculation represents the cost of the FinOps tooling itself, not the savings generated. The true ROI of Agentic FinOps lies in its ability to autonomously identify and remediate thousands of dollars in wasted compute—action that passive dashboards historically fail to drive. By shifting FinOps left and embedding it directly into the engineering workflow via ADK and Gemini, organizations transform cloud spend from a centralized reporting chore into a distributed, automated engineering discipline.