Why AI Agents Should Propose Infrastructure, Not Execute It
AI agents with direct cloud API access risk emergent infrastructure mutations. A governance model splits propose, judge, and execute authority.
Major cloud vendors now ship MCP servers that let AI agents call infrastructure APIs directly — discarding the governance properties a decade of infrastructure-as-code was built to provide. Recent incidents, including Replit's agent deleting a production database during a code freeze and a compromised Amazon Q extension shipping a prompt injection meant to wipe local and cloud resources, show what happens when destructive authority is reachable from probabilistic execution with live credentials.
The deeper risk isn't a single bad command but emergent mutations: in multi-step agent chains, an infrastructure change becomes a side effect of reasoning, several steps removed from the original request. As agent throughput scales, mutation volume grows while human review capacity stays flat — breaking the assumption that IaC-era governance depends on.
The proposed fix separates the authority to propose, judge, and execute a change across distinct actors, with the agent holding only proposal power. Agent intent is translated into a Terraform/OpenTofu artifact, checked against OPA policy; self-fixable violations trigger a regenerate-and-resubmit loop, while non-fixable ones escalate to a human. Only a single gated apply stage — never the agent — is allowed to touch production.