AI Coding Agents
Infrastructure
Safer infrastructure as code changes with agents
September 24, 2026 - 2 minute read
Infrastructure as code changes can widen access or replace a stateful resource from a small diff. Valid syntax is insufficient for an agent-prepared change. Reviewers need to see what the provider plans to do in the intended environment and which policy checks constrain it.
The terraform plan command previews the changes Terraform proposes for the current configuration and state. That plan is evidence, not an approval. Values can remain unknown until apply time, and the result depends on the selected workspace, variables, provider versions, and current remote state.
Scope infrastructure as code changes
Give the agent a narrow outcome and name the allowed modules, accounts, regions, and environments. Include the expected resource changes and state whether deletion, replacement, or privilege expansion is allowed. A request such as “add the staging queue and its alert” is reviewable. “Improve the cloud setup” leaves the blast radius undefined.
Pin the toolchain before editing. Identify the Terraform or OpenTofu version, provider lockfile, backend, workspace, and variable source. Apply Factory’s remote delegation guidance by naming the staging queue to add, the account in which to plan it, and the expected absence of resource replacements or wider permissions. Include the verified formatting, validation, and policy commands. Forbid apply commands unless the run is explicitly authorized.
Review infrastructure as code plans
Ask the agent to produce a fresh plan from the target environment after it changes the configuration. Review the human-readable plan and retain machine-readable output in an access-controlled artifact store when policy tooling needs it. For the staging queue, an IAM change from its specific resource ARN to * would expand access beyond the task even if validation passes and no resources are destroyed.
A clean plan can still encode the wrong intent. Compare it with the request and architecture boundary. If a policy-critical value is “known after apply,” leave the corresponding check unresolved and require an approved way to verify it. Unknown does not mean safe.
Factory’s automated code review can run repository-specific review guidance on pull requests. Infrastructure guidance can require a redacted plan summary and flag unapproved destructive changes or edits outside the named modules. Keep deterministic policy engines and provider validation in CI because an AI review complements those controls rather than replacing them.
Keep application separate from preparation
Separate the identity that proposes a change from the identity allowed to apply it. Pull request automation should use read-only or planning credentials where the provider supports them. Production application should remain behind the existing approval and deployment path. Do not copy credentials into prompts, logs, plan artifacts, or repository files.
The pull request should include the requested outcome, changed modules, plan summary, policy results, rollback considerations, and any values that remain unknown. It should also state the exact environment used to generate the plan. Reviewers can then distinguish a code-only check from evidence tied to current infrastructure.
Stop when state access fails, the target workspace is ambiguous, or the plan includes an unexplained replacement or deletion. A blocked report protects infrastructure better than a speculative edit followed by an unverified plan.
