Plan and apply runs

When a change is proposed in a connected repository or queue, the agent triggers a Terraform plan, reads the proposed additions, changes, and deletions, and applies your rules to decide what may proceed. Low-risk, in-policy plans can be applied and the run result written to the workspace. Anything that would destroy resources, touch production, or exceed a cost threshold is never applied automatically: the agent posts the plan summary and routes it to an engineer, who reviews the diff and approves the apply themselves before it runs.

Drift detection on state

On a schedule, the agent reads the current Terraform state and compares it against real infrastructure to find drift where resources changed outside of code. It applies your rules to classify each difference and notifies the owning team with a clear list of what moved. Trivial, expected drift can be noted and closed; changes affecting security groups, access, or production capacity are escalated to an engineer rather than corrected on their own, so a person decides whether to realign the state or update the configuration to match.

Policy checks before apply

Before a run is applied, the agent reads the planned changes and evaluates them against your policy rules, checking naming conventions, required tags, region limits, and other guardrails. Plans that pass are marked compliant and allowed to continue; those that fail are held with the specific violations listed. The agent notifies the requesting engineer and does not override a failed check, so exceptions are always granted by a person. This keeps every applied change measured against the standards your team agreed on, with humans owning any waiver.