Four evaluation engineering lessons learned from building agent plugins

Google Cloud released the Google Cloud Developer plugin alongside an operational analysis detailing four evaluation engineering lessons for agent plugins, according to Google Cloud Blog's report. Written by Casey West, Developer Relations Lead for AI Infrastructure and Applied Engineering, the report notes that reliable agentic systems require rigorous measurement rather than simple prompts. The plugin served as a live testbed to validate testing principles across real cloud operations.

This report details the testing methodologies, telemetry extraction rules, and failure modes discovered during the plugin's development. It provides software engineers, cloud architects, and platform teams building agent tools or Model Context Protocol servers with practical testing guidance to replace superficial checks with trajectory grading. The findings explain why evaluating summary text produces false negatives, how parallel dispatch causes race conditions, and why side-by-side dry runs expose hidden governance failures.

Four evaluation engineering lessons learned: what actually changed

Google Cloud updated its agent evaluation strategy after discovering that LLM-as-judge graders produced false negatives on operational tasks. During tests on an 11-prompt evaluation suite for the Google Cloud Developer plugin, an automated grader marked the plugin as failing three prompts. When engineers inspected raw tool-call transcripts, the plugin had actually passed all three. On a Cloud Run cleanup prompt requiring syntax validation, the agent ran gcloud help run services list first. Its final message focused on warning about permanent data loss rather than reciting the syntax check. The grader penalized the agent for omitting the detail from its summary despite proper execution.

In response, the team shifted from evaluating conversational summaries to scoring complete execution trajectories. Under this updated framework, evaluation pipelines inspect the raw sequence of tool calls to verify which commands were executed, validated, and scoped during runtime. The automated system checks underlying API actions rather than relying on what the model claims it performed in its closing text. This trajectory-first methodology prevents evaluators from guessing model actions and eliminates penalties for agents that prioritize user-facing safety warnings over administrative checklists during technical cloud workflows.

Four evaluation engineering lessons learned: how it works

The evaluation harness requires capturing telemetry that preserves turn structures rather than flattening events into a sequential timeline. Modern agent harnesses often batch several tool invocations into a single assistant turn via tool_calls arrays. In Google Cloud's tests, when an agent inspected an environment and retrieved documentation, the harness dispatched a skill-loading call and two documentation searches simultaneously. Because skill activation involves a two-stage process where an initial call returns a launch stub and a second turn injects complete instructions, the searches ran before the instructions arrived. Flattened telemetry completely obscures this parallel dispatch race condition.

The framework also pairs live testing with credential-free plan-only runs side by side. Live conditions equip agents with sandboxed credentials to execute real commands, testing parameter serialization, syntax accuracy, and operational restraint. Conversely, plan-only runs strip credentials and prompt the agent to explain its intended actions without invoking tools. This dry-run condition isolates model reasoning from permission blockers that often halt live runs prematurely. In one onboarding test, a live run halted on step two due to a project list permission error, while the plan-only run produced an 8,000-character plan that ignored organization policies and approvals.

Four evaluation engineering lessons learned: why it matters now

Systematic evaluation engineering is critical because one-shot demonstrations fail to reflect the reliability demands of enterprise infrastructure. Watching a model solve a coding puzzle or build a small game in a single pass acts as a vanity metric rather than a rigorous test. Enterprise agents must manage multi-step interactions, navigate complex permissions, and avoid catastrophic mistakes. For instance, an agent asked to identify cost-saving opportunities might delete an entire cloud project without proper safeguards. Evaluation suites measure true system behavior across edge cases, providing the verification needed before deploying autonomous tools across production environments.

Evaluation suites also establish durable baselines against rapid foundation model changes and evolving harness standards. Frontier model architectures update every few months, rendering ad-hoc prompt testing obsolete. Google Cloud addressed this non-deterministic environment by using expert-curated golden sets as continuous integration baselines. These golden sets capture ideal execution trajectories across the composite stack, including the model, harness, and plugins operating on realistic tasks. When underlying models or plugin manifests change, scoring runs against human-verified golden sets confirms whether agent behavior, tool scoping, and safety constraints remain reliable across updates.

Four evaluation engineering lessons learned: who is affected

Engineers developing agent plugins, Model Context Protocol servers, and cloud automation tools are directly impacted by these testing requirements. Developers building extensions for platforms such as Antigravity must inspect how client harnesses handle parallel tool dispatch and skill injection timing. If harnesses trigger concurrent tool calls before injected instructions enter the prompt context, agents will disregard embedded guidance despite unambiguous developer prompts. Tool builders must maintain structured telemetry to detect these client-side execution timing issues, ensuring that custom plugins, tool parameters, and manifest configurations execute in the proper sequence during runtime.

Cloud administrators and enterprise security teams evaluating agent deployments must also adapt their governance protocols based on these lessons. Relying solely on live testing can create a false sense of security when early permission errors mask dangerous intent. As demonstrated in Google Cloud's onboarding evaluation, an agent that aborts early on an access error may contain internal planning logic that bypasses organizational policies and administrative sign-offs. Security architects must incorporate plan-only evaluations into audit workflows to inspect unconstrained model planning, verifying that autonomous systems adhere to enterprise compliance boundaries before granting live credentials.

Four evaluation engineering lessons learned: what to watch

Engineering teams should track how Google Cloud integrates these evaluation standards into documentation and codelabs for the Google Cloud Developer plugin. As developers adopt the plugin within Antigravity, testing workflows will increasingly incorporate trajectory scoring and dual-track evaluations into standard deployment cycles. Teams building agentic integrations should audit existing test pipelines to replace single-pass demos with structured benchmark suites. Monitoring whether agent harnesses preserve turn boundaries during simultaneous tool calls will serve as a crucial benchmark for identifying runtime race conditions before plugins reach production environments.

The broader developer ecosystem will also watch how golden sets and trajectory-based continuous integration evolve for agent plugins and Model Context Protocol implementations. As cloud providers expand autonomous developer tools, standardized benchmarks will help teams manage frequent foundation model upgrades without experiencing silent operational regressions. Organizations should observe how runtime environments implement side-by-side live and dry-run execution modes to validate security policies. Establishing human-curated golden sets across models, harnesses, and plugins will remain the primary method for ensuring enterprise agents perform reliably as underlying AI technologies advance.