Skip to content

docs: clarify IaC runtime verification and access boundaries #193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oycyc merged 1 commit into from
Oct 28, 2026
Merged

docs: clarify IaC runtime verification and access boundaries #193

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion content/blog/2026-10-20-ai-verification-fix-loop-iac.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@ For an ECS task timing out against RDS, [VPC Reachability Analyzer](https://docs

A `false` result with a blocking security group gives the agent a specific failure to investigate. It fixes the HCL, applies in the sandbox, and reruns the analysis within the permitted change scope.

Reachability Analyzer checks the network configuration, but it doesn’t send traffic. After the analysis passes, verify that the application can query the database, using credentials limited to the required read access.

## Define the Verification and Fix Loop in Repository Instructions and Agent Skills

Run the usual formatting, validation, linting, and security checks first. Our [CI checklist post](/blog/terraform-opentofu-ci-checklist/) covers the setup.
Expand Down Expand Up @@ -121,6 +123,6 @@ A [Stop hook](https://code.claude.com/docs/en/hooks#stop) can also require a ver

The agent hands back a Pull Request with the code and explains the expected versus actual changes and includes any required behavior-test results. It also describes the unexpected changes it found and corrected, along with anything still unverified. If it is blocked, it returns the specific problem, what it tried, and the relevant runs.

The human still reviews the code and final plan, confirms that the acceptance criteria cover the intended change, and checks any gaps in runtime verification. A passing sandbox test covers the tested environment; the production deployment still needs its own reviewed plan and checks.
The human still reviews the code and final plan, confirms that the acceptance criteria cover the intended change, and checks any gaps in runtime verification. A passing sandbox test covers the tested environment. Production still needs its own reviewed plan, approved deployment, and checks that confirm the intended behavior. Keep verification access separate from deployment permissions and limited to what those checks require.

At Masterpoint, we expect the agents to review infrastructure plans to ensure they match what we intended and review them ourselves first before asking another engineer / teammate for review.
Loading