Scheduled agent runs reuse a sandbox: plan file ownership

Scheduled agent runs make file ownership a reliability decision

A recurring agent job that reuses its sandbox is not starting from a blank directory. Google’s managed-agent documentation says a scheduled trigger binds an agent, environment, prompt, and cron schedule to a persistent resource; each run reuses the same sandbox, so files persist across executions. It also describes an Environments API for listing, inspecting, and deleting sandbox sessions instead of simply waiting for a seven-day TTL.

That behavior suggests a useful runbook, but not a universal platform contract. Before putting a scheduled worker in production, classify every path it can touch:

  • Run-scoped inputs: materialize from a manifest, validate at start, and remove temporary copies at the end.
  • Reusable artifacts: keep only outputs with an owner, schema/version, and retention rule. Make the next run read an explicit manifest rather than “whatever is in the directory.”
  • Execution state: persist checkpoints separately from generated files, with a clear rule for resuming or abandoning an interrupted run.
  • Cleanup: delete expired sessions and transient data deliberately; retain logs and artifacts only for the period needed to debug or audit them.

The key boundary is ownership. A managed sandbox may provide persistence and lifecycle operations; an application that calls a model through an API gateway still owns its scheduler, queue, storage, retries, and cleanup unless its chosen product documentation says otherwise. Model access alone does not prove that managed triggers or an Environments API are available.

A practical acceptance test is to run two identical jobs against a fresh and a reused environment. Record which files are present before startup, which outputs are committed, and what cleanup removes. Fail the deployment if a run can consume an unmanifested predecessor artifact or if deleting an environment leaves production state ambiguous. This keeps reuse useful without turning accidental leftovers into hidden input.

I would make the file-ownership policy visible at the point where someone changes a recurring task, not just in its runbook. My design recommendation is to separate three actions: pause future runs, start the next run with fresh working files, and delete retained artifacts. Those labels should describe different application operations; a single “Reset task” button leaves too much to interpretation.

For example, when an operator changes a weekly report’s input folder, the confirmation could show which prior outputs remain eligible as inputs and offer an explicit choice to carry them forward or exclude them. That is a proposed interface contract, not a claim about controls supplied by Google’s managed environment.

A reset preview should list what will be removed, what will survive, and whether an active run must finish before the change takes effect. It should also distinguish clearing the working directory from deleting copies already exported elsewhere. The tradeoff is extra friction, so I would reserve the detailed confirmation for changes to retention or reuse rather than every scheduled execution.

An acceptance test from the user side: can someone predict the next run’s inputs and the fate of the last report from that preview alone? If not, an explicit backend manifest still leaves the operator guessing about what “fresh” means.