Platform Engineering Labs just shipped beta support in formae for GCP, Microsoft Azure, Oracle Cloud Infrastructure, and OVHcloud. That’s the headline. The real story: a provisioning-focused IDP is now a multi-cloud control plane, and teams that treat the cloud provider toggle as a checkbox are about to inherit a complex set of trust and operational problems.
Formae's update makes it straightforward to declare and provision cloud resources across four major clouds from the IDP layer. For platform teams that have been using a single provider or ad-hoc Terraform modules, that's a productivity win—one golden path, one pipeline, fewer bespoke repos. But provisioning is the easy part. The hard parts come from identity, ephemeral credentials, agent execution, and cost telemetry.
Two relevant trends collide here. First, platform engineering is rapidly shifting toward AI-native IDPs that must handle agents, non-human identities, GPU workloads, and new runtime patterns. Second, developer trust is emerging as the primary metric that determines whether an IDP actually gets adopted. You can stitch multi-cloud provisioning onto an internal portal overnight; you can't retrofit trust once developers and autonomous agents start operating across account boundaries.
Why this matters in practical terms
-
Identity surface area explodes. Each cloud exposes different identity primitives (service accounts and Workload Identity/Workload Identity Federation on GCP, Managed Identities on Azure, instance principals and dynamic groups on OCI, API/service credentials on other providers). When provisioning flows span multiple providers, the IDP becomes the hub for cross-cloud credential issuance. If the IDP issues long-lived keys or lacks granular per-agent attribution, you've just created a multi-cloud blast radius.
-
Agent workflows change the game. Teams increasingly run agents (human-triggered and autonomous) from their IDPs. Agents demand short-lived, scoped credentials, auditable sessions, and limits on concurrent or cumulative resource use. Without per-agent identity and session audit trails, remediation and forensics are much harder—and platform teams lose their single pane of accountability.
-
Cost and governance become real-time concerns. Multi-cloud provisioning without near-real-time cost visibility is dangerous. An IDP that can spin up GPU instances in multiple regions needs cost tagging, enforcement gates, and billing-aligned guardrails integrated into the provisioning flow, not bolted on afterward.
Formae’s multi-cloud beta is the right product-level move. Identities and clouds converge at the provisioning layer; the IDP is the right place to centralize policy, tagging, and lifecycle. But this is overdue: shipping provider support without identity-first controls and agent-aware telemetry is a half-measure that will produce noisy, brittle platforms.
Platform teams should demand three things from their IDP control plane (and if formae's roadmap doesn't include them, expect others to build it): per-agent identities with short-lived credentials and auditable sessions; policy-enforced resource quotas and pre-provisioning cost gates; and a clear mapping from IDP actions to cloud-native IAM artifacts so cloud audit logs tell a coherent story.
This is also where measurement matters. Recent platform engineering research recommends using Four Keys and DORA-style signals to measure IDP impact—apply the same rigor to platform trust metrics. Count agent-attributed deployments, mean time to revoke a session, and per-environment cost variance. Those numbers decide whether multi-cloud provisioning increases velocity or multiplies risk.
Call it: adding multi-cloud providers is the right move for formae and for IDPs in general. The wrong move would be to treat provider parity as the product. The hard engineering and organizational work is building identity-first, agent-aware control planes and the telemetry to prove they work.
If your roadmap for multi-cloud starts and ends with Terraform providers, you’re building a faster footgun. The product win in this beta is enabling multi-cloud workflows; the operational challenge will be whether platform teams use that capability to centralize governance—or whether they scatter trust across four new clouds. My bet: teams that ignore per-agent identity and real-time cost telemetry will be the ones rewriting their platform two quarters from now.