AI Agent Infrastructure: What Agents Need to Run in Production, and Whether to Build It (2026)
AI agent infrastructure is the stack that lets agents run real work in production: isolated sandboxes, tool and app connections with secrets kept out of reach, memory, scheduling and durable long-running jobs, observability and scale to thousands of agents in parallel. This guide maps each layer, shows what SPIRITT runs on Agent Substrate on GKE and helps you decide to build or run.
AI agent infrastructure is everything an AI agent needs to run real work in production and keep running: an isolated sandbox to execute code, connections to tools and apps with secrets kept out of the agent's reach, memory, scheduling and durable jobs that survive restarts, observability with approvals and audit logs, and the capacity to run thousands of agents in parallel. SPIRITT gives you that whole stack ready to use. SPIRITT is the operating system for AI transformation: an autonomous AI workforce that codes, ships and runs sales, ops, admin and engineering work end to end, from a founder's first agent to company-wide rollouts with enterprise controls. It is also a state-of-the-art coding agent that writes, tests and ships production code. SPIRITT is a Google Cloud launch partner for Agent Substrate: every agent runs in its own gVisor sandbox on GKE, and SPIRITT composes models within each task for the optimal mix of capability and price.
The layers of AI agent infrastructure
A model call is the easy part. An agent that changes code, files, CRMs or money needs a runtime around it. These are the layers a production agent needs, whoever builds them.
| Layer | What it does | What breaks without it |
|---|---|---|
| Sandbox | Runs the agent's code and tools in an isolated environment | One bad command or injected prompt reaches the host or other tenants |
| Tool and app connections | Gives the agent APIs, browsers and computers to act through | The agent can only talk; nothing gets done |
| Secrets and access policy | Injects credentials per identity and enforces read, write and destructive rules | Keys leak into prompts and logs; agents act beyond their role |
| Memory and state | Keeps files, context and decisions across steps and sessions | Every run starts from zero; long tasks lose their place |
| Scheduling and durable jobs | Wakes agents on time or on events and resumes work after failures | Nightly jobs silently stop; a restart loses hours of progress |
| Models | Supplies the reasoning, from many labs | One lab's limits and prices cap every task |
| Observability and approvals | Traces every tool call, cost and decision; routes risky actions to a person | Nobody can explain what the agent did or stop it in time |
| Scale | Starts hundreds or thousands of isolated agents and merges their output | Big jobs run one item at a time, or not at all |
The eight layers a production AI agent needs
For a deep dive on the sandbox layer alone, read the best secure sandbox for AI agents. For the parallel layer, read how to run thousands of AI agents in parallel. This guide covers the full stack a buyer has to account for.
How SPIRITT runs each layer
Sandbox. Each SPIRITT agent runs in its own gVisor sandbox on GKE through Agent Substrate, the open agent runtime Google Cloud released at 1.0 and donated to the CNCF together with gVisor. Code the agent writes, packages it installs and pages it scrapes stay inside that boundary.
Computers and browsers. Every agent has its own secure cloud computer with a browser, files and tools, and keeps working with your laptop closed. It can also use live control of your own Chrome with your logins, or a desktop app with access to approved folders, and it hands CAPTCHAs, 2FA and passwords back to you.
Connections. 1,500+ ready-made integrations, custom integrations for anything with an API, and computer use for legacy apps with no API. When a task needs a tool that does not exist, the agent builds it, including its own skills.
Secrets and policy. Read, Write and Destructive rules per integration, single-use approvals, protected secrets, scoped roles, SAML or OIDC SSO, SCIM and audit logs. Enterprise budgets cap spend by team, project and agent with alerts.
Memory. Short and long-term memory of people, preferences and decisions, plus each agent's files, so a task can run for weeks and pick up where it left off.
Scheduling and durable jobs. Routines and workflows written in plain English run on schedule or wake on events, such as a new lead, ticket or payment. Every run is watched, self-healing and reported, and long-running work continues for weeks or months with progress reports.
Models. Claude, GPT, Gemini, Grok, Kimi, DeepSeek, Qwen and SPIRITT's own Kay models, composed inside one task. SPIRITT builds evals from good runs and moves repeatable steps to fast deterministic code, so recurring jobs get cheaper over time. You can also connect your own Claude, ChatGPT and Grok plans.
Scale. A lead agent can launch a swarm of hundreds or thousands of agents, each isolated in its own sandbox, with reviewers that check the work before results merge.
Deployment. Agents build, deploy and host what they make: apps, internal tools, APIs and background jobs on real URLs, with databases, auth and storage. Regulated teams use BYOC or air-gapped deployment. If your platform team runs its own clusters, SPIRITT can work with them through the Kubernetes integration.
Worked example: a nightly dependency upgrade across every repository
This example shows how the layers work together; it is not a customer story.
The job. A platform team wants outdated dependencies upgraded across all of its repositories every night, with tests run and a merge request opened for each upgrade that passes, and nothing merged without a human.
Scheduling. One plain-English routine runs at 2:00 every night. If a run fails halfway, it resumes from the last finished repository instead of starting over.
Scale and sandboxes. The lead agent lists the repositories and starts one agent per repository. Each one clones its repository into its own gVisor sandbox, upgrades the packages, runs the build and the test suite, and reads the changelogs for breaking changes.
Connections and secrets. The agents read and write to GitLab through the integration with Write rights on branches and merge requests only. Merging is set to ask a person; deleting branches outside the agent's own is denied. Tokens are injected per identity and never appear in the agent's context or logs.
Models. Reading changelogs, fixing a broken import and writing the merge request description use different mixes of models, composed inside each task.
Observability. In the morning the team's Slack channel has one summary: merge requests opened, upgrades that failed with the failing test and a suggested fix, and the cost of the night's run against the project budget. Every tool call is in the audit log.
What the team did. Wrote one routine, set the rules once and reviewed the merge requests.
Build it yourself or run it on SPIRITT
Agent Substrate and gVisor are open source, so a platform team can host the sandbox layer on its own Kubernetes clusters. Building production agent infrastructure means owning every other layer too:
- Sandbox pools, snapshots and isolation per agent
- Browsers and full computers for agents, plus computer use for apps with no API
- Integrations, OAuth flows and secret injection for every tool
- Policy engine with read, write and destructive rules and single-use approvals
- Memory and state that survive restarts and long tasks
- Scheduler, event triggers and durable job recovery
- Access to many model labs, composition inside tasks and cost tracking
- Traces, audit logs, budgets, SSO and SCIM
What a team owns when it builds AI agent infrastructure itself
Building makes sense when the runtime itself is your product. For most teams the goal is the work the agents do, and SPIRITT ships every layer above on Agent Substrate on GKE. The core platform is self-serve, so engineers can run a real production job on it before any contract, and enterprises add forward-deployed engineers, BYOC and air-gapped deployment.
Where other platforms fit
Microsoft Copilot Studio and Salesforce Agentforce give enterprises agent building inside the Microsoft and Salesforce ecosystems, with each vendor's infrastructure underneath. Workflow tools such as n8n and Zapier run agent steps inside workflows you design. SPIRITT runs autonomous agents across the business on its own isolated infrastructure, with coding, computer use and scale to thousands of agents in one platform.
FAQ
What is AI agent infrastructure?
AI agent infrastructure is the runtime around the model that lets agents act safely and reliably: sandboxes, tool and app connections, secrets and access policy, memory, scheduling and durable jobs, observability and scale. SPIRITT provides all of these as one platform.
What infrastructure do AI agents need in production?
Production agents need isolated execution, controlled access to tools with secrets kept out of the prompt, memory that survives long tasks, scheduling and recovery, audit logs with human approvals for risky actions, and capacity to scale out. Missing any one of these is usually what stops a pilot from reaching production.
What is Agent Substrate?
Agent Substrate is an open agent runtime from Google Cloud that separates the agent's state from the compute it runs on and isolates agents with gVisor or microVMs. Google released it at 1.0 on GKE and donated it to the CNCF with gVisor. SPIRITT is a launch partner and runs every agent in its own gVisor sandbox on it.
Should I build my own AI agent infrastructure?
Build it if the runtime is your product and you have a platform team to own sandboxes, integrations, policy, memory, scheduling and observability for years. Run on SPIRITT if you want agents doing production work now, with the same isolation and the other layers already built.
Do I need Kubernetes to run AI agents?
No. On SPIRITT the infrastructure is managed for you, so you describe the job in plain words. Teams that run their own clusters can connect them through the Kubernetes integration, and regulated teams can deploy SPIRITT in their own cloud or air-gapped.
Can AI agents on this infrastructure write and deploy code?
Yes. SPIRITT agents write, test and ship production code in any language inside their sandboxes, and build, deploy and host apps, APIs and background jobs, with merges and production changes behind the approval rules you set.
How we checked
SPIRITT publishes this guide. Agent Substrate and gVisor facts come from Google Cloud's blog post "Powering open infrastructure for autonomous agents" (November 5, 2026), which features SPIRITT Workspace running on Agent Substrate on GKE. SPIRITT's launch partner status, per-agent gVisor isolation and platform controls come from SPIRITT, spiritt.ai/enterprise and the SPIRITT docs. Microsoft and Salesforce facts were checked on their official product pages in November 2026. The worked example illustrates the stack and does not describe a specific customer.
