AI Agents Should Propose Infrastructure, Not Mutate It dropdown to pick auto / light / dark.<br>gives a no-JS open/close for free; the script below<br>wires selection, persistence, and closing. Icons + text labels.<br>Sits at the far right of the bar, past the nav links. --> Auto<br>Light<br>Dark
Most major cloud vendors now ship an MCP server that can alter your infrastructure. This is easy to build and it demos well.
It also throws away the governance properties that a decade of infrastructure-as-code was built to provide, at the moment they matter most.
You have probably seen the incident reports already, so links only, as a recap:
Replit’s agent deleted a production<br>database<br>during an explicit code freeze.
A compromised release of the Amazon Q extension for VS Code shipped with<br>an injected<br>prompt<br>telling the agent to wipe local filesystems and cloud resources through<br>the AWS CLI. The payload reportedly never ran — a syntax error, not a<br>control, stopped it.
The first is an agent doing its own job badly. The second is an agent doing a job an attacker gave it.<br>The mistake is the same in both: destructive authority reachable from probabilistic execution, with credentials.
Mutations become emergent
“Agent XYZ, create me a database” is not the demo case that matters. That’s a<br>voice-activated console: a human forms the intent, a model transforms it into the<br>command. You could have built it with Alexa many years ago.
The more interesting question is what day-2 operation looks like.
A developer asks an agent for a new feature. The agent splits the work<br>across sub-agents, and one of them decides the service needs a database<br>user, ACLs, and a topic with specific retention. Or: “my queries are slow” —<br>and three reasoning steps later, an agent concludes the instance is<br>undersized and bumps it a tier.
In these chains, the infrastructure mutation is a side effect of reasoning .<br>It’s emergent — several layers removed from the request that triggered it.
The arithmetic breaks. Agents reduce the cost of producing<br>a change, so mutation volume grows with whatever agent<br>throughput an organization buys. Review capacity doesn’t grow with it (yet?): it is<br>still humans, at human cadence. The governance models we relied on<br>assume those two rates are matched. When mutation volume outruns review<br>capacity, the review either becomes the bottleneck or stops being real.
Status quo
The common chain today runs on a developer’s machine:
The agent’s host launches the vendor’s MCP server as a local process<br>and gets the tools list: create_database, update_acl,<br>delete_topic — each with a JSON schema for its arguments.
The model picks a tool mid-task: it decides it needs a database, finds<br>create_database in the catalog, and fills in the arguments from<br>whatever context it has.
The MCP server translates the call to the cloud API — using the<br>credentials it inherited from the developer’s environment. The API<br>executes. The resource now exists.
The result returns to the model as a tool result.
Note which identity did the mutating: the developer’s. The agent has no<br>principal of its own, so the audit trail shows a human, and no IAM rule<br>can even tell the agent’s calls from the developer’s. The host asks for<br>per-call confirmation — until the human clicks “always allow.”
AWS, Google and Azure now host remote MCP endpoints behind OAuth and IAM: the agent gets<br>its own identity, every call is authorized — may this principal use the<br>protocol, may it touch this resource — and everything appears in the audit<br>log. Request-level governance exists.
The regression
An agent calling cloud APIs mutates infrastructure the way an engineer<br>clicking through a console did in 2014.
That model was retired because it didn’t survive scale.<br>Infrastructure-as-code introduced a declarative, versioned, checkable<br>artifact between intent and effect. Those properties did not become<br>acceptable to lose because the caller is now an agent.
The thesis
Separate the powers. The authority to propose an infrastructure<br>change, the authority to judge it, and the authority to execute it must<br>belong to different actors — and the agent holds only the first.
This is constitutional design, applied to machines.<br>Power is split this way for the old reason: no single<br>actor can be trusted to be right every time, so the guarantee is placed<br>in the structure, not in the actor’s character.
The alternative introduces no new capability. It’s the same governance IaC<br>already gave us, rebuilt for a caller that is fast and concurrent:
The agent produces intent, not API calls. “I need a Postgres instance<br>for service X.”
A server-side layer turns the intent into a declarative artifact —<br>Terraform/OpenTofu HCL — based on the organization’s existing<br>estate and approved modules.
The artifact is planned against current state, and the plan is checked<br>against organizational policies (OPA).
Denial is a negotiation. Policy violations come back to the drafting<br>step as structured, machine-readable hints. The...