Eight ways to let AI agents manage cloud infrastructure, scored on safety guardrails

What the guide sets out to answer

As dev.to reported, a guide on the platform compares eight ways to let an AI agent set up and run cloud infrastructure without handing it unchecked power. The disclosure comes first: Control Plane, one of the eight options, published the guide. Read the scoring with that in mind.

The eight fall into three groups. One is a platform with a built-in MCP server (the Model Context Protocol, a standard way for AI tools to connect to a service): Control Plane. Another is three cloud-provider agent services: Amazon Bedrock AgentCore, Microsoft Foundry Agent Service with Entra Agent ID, and Google's Agent Runtime. The last group is infrastructure as code, where configuration files describe what to build, paired with rule engines: Terraform with HCP Terraform, Pulumi, Crossplane, and Kubernetes with OPA Gatekeeper or Kyverno.

Each is rated on five things: how the agent gets its identity and permissions, whether there is a plan or read-only mode, whether destructive changes need approval, whether actions are logged, and whether spending and resources are limited. A rating of Yes means built in. Partial means built in with caveats. "You add it" means you must supply the control yourself.

Where the options agree and where they don't

The strongest agreement is on logging. All eight keep a record of what the agent did, whether through AWS CloudTrail, Azure's activity logs, Google's audit logs, Terraform run history, Pulumi's update history, or Kubernetes audit logging.

Previews are more mixed. Terraform shows a plan before every apply, and Pulumi shows a preview before every update. Control Plane gets a Yes through a read-only profile that exposes no tool able to create, change, delete or run anything, and that profile cannot be widened mid-session. The three cloud-provider services get a Partial: you can limit an agent to a viewer-style role, but they have no plan step.

Spending limits are the weakest area. No option earns a clean Yes. Most offer quotas that cap how many resources exist or how large they can grow, while budgets and cost alerts often live in a separate service. Terraform can fail a run when its estimated monthly cost passes a set threshold, but the guide notes it has no account-level budget cap. Pulumi and the Kubernetes-based options have no dollar limit at all.

The approval gap

The most important guardrail may be a human saying yes before something is deleted or a production system changes. Here the results split sharply.

Terraform is the only Yes. With automatic apply turned off, a person must confirm each plan, and a failing mandatory policy stops the run unless someone with override rights lets it through. Control Plane, Pulumi and Microsoft's service each get a Partial. Control Plane marks destructive tools and tells the assistant to explain the impact and ask first, but that is an instruction, not a hard lock. Teams that want a firm gate route changes through its Terraform or Pulumi provider in their own pipeline.

Amazon's service, Google's service, Crossplane, and Kubernetes with its policy engines all fall under "You add it." For Kubernetes, the guide's point is that policies can turn a request away but cannot pause it for a person to review. If you pick one of these, plan to build the approval step yourself, for example through pull request review.

What an agent should never be allowed to do

Beyond the matrix, the guide lists behaviors to rule out entirely:

• Standing admin access. A hijacked agent with permanent top-level rights could alter permissions, delete data and read every secret.
• Secrets in code or prompts. Passwords and keys can leak through commits, logs, provider retention or prompt injection, where hidden instructions trick the model.
• Unsupervised deletion or production changes. Actions that cannot be undone need a person in the loop.
• Obeying text found in logs or tool output. Content an agent reads can contain planted instructions.
• Running unreviewed code on a developer laptop. A compromised agent there can reach whatever the developer can.

The guide also recommends short-lived credentials over long-lived keys, a separate identity for each agent, and a way to roll back each change.

How to read the scores

The ratings reflect what each vendor or project documents today, not independent testing, and the guide's author is also one of the vendors. The scores are most useful as a list of questions to put to any setup, including ones not on the list.

Also note that the grouping reflects each option's main approach to governance. The guide says Terraform, Pulumi and the cloud providers also publish MCP servers, so the lines between the categories are blurry.