Golden paths

Golden paths are the foundation of agentic resource management. They are how you deliver engineering velocity without giving up governance, for both developers and AI agents.

What is a golden path?

A golden path is the "how-to" of your organization. It is the approved, opinionated way of provisioning and operating a resource, and it accounts for everything your platform team cares about:

• Standards - naming, tagging, structure, and ways of working.
• Compliance - required policies, approvals, and audit trails.
• Cost - right-sized resources and cost controls baked in.
• Security - least-privilege access, secret handling, and secure defaults.
• Stability - configurations that hold up in production.

Golden paths are not about restricting choice. They are about making the right choice the easy choice. When the approved path is faster and safer than doing it yourself, developers and agents naturally follow it.

How it connects to self-service

Golden paths solve the too-slow / too-loose tension described in the overview.

• Without self-service, golden paths live in a wiki that nobody follows, so provisioning falls back to tickets (too slow) or shadow infrastructure (too loose).
• When golden paths are self-serviceable, developers and agents get instant, governed provisioning. The fast path and the compliant path become the same path.

Full lifecycle management

Golden paths cover the full lifecycle of a resource, not just its creation. Day-0 provisioning is only the beginning. Day-2 operations, everything that happens after a resource exists, are just as important and just as prone to becoming a bottleneck.

Consider the lifecycle of an S3 bucket: create it, back it up, delete it, restore it. Each of those is a golden path in its own right, with its own standards and guardrails.

Port lets you define self-service golden paths for common day-2 operations, including:

• Scaling resources up or down: scale ECS tasks, scale autoscaling groups, change Kubernetes replica count.
• Patching and updating configurations: toggle a feature flag, add tags to existing EKS clusters.
• Restarting and resyncing to resolve issues: reboot an EC2 instance, sync an ArgoCD application.
• Decommissioning resources: terminate an EC2 instance, delete a Kubernetes namespace.
• Monitoring usage and health: monitor and purge SQS queues.
• Rotating secrets and credentials: renew an ACM certificate.

How a golden path is implemented in the AI era

In the agentic era, a golden path is more than a form and a backend script. It is an agentic workflow that combines automation, context, guardrails, and human judgment.

• Agentic workflows using tools and skills. Workflows orchestrate the steps of a golden path. The AI action node and skills encode the "how-to" so agents perform specialized provisioning tasks consistently.
• Context. A golden path runs against real context: existing resources in the software catalog, your Terraform modules, and other GitOps templates. Agents query this context instead of guessing, so their output matches your standards.
• Permissions and guardrails. Every golden path enforces RBAC, manual approvals, and dynamic permissions. Low-risk requests flow through automatically; high-impact changes require review. The same guardrails apply whether the request comes from a human or an agent.
• Human-in-the-loop nodes. Where your policy requires a person in the loop, self-service trigger and approval steps pause the workflow for review before it continues. Humans stay in control of the decisions that matter, and everything else is automated.

Next steps

• Multi-cloud single pane of glass - see how this pattern extends across every cloud and on-prem environment you run.