Hi HN — we put together an Infrastructure Agents Guide and open sourced it.
AI is being used actively for infra already today, but the knowledge is still scattered. Every infra team I talk to is re-discovering the same stuff: what permissions to give, how to keep changes reviewable, how to audit what happened, what to do when the agent is wrong, and how not to end up with “LLM + admin role” in production.
If you’re buying an agent, use it like a checklist:
can we run it read-only and keep it that way?
how does it get creds (short-lived? scoped? per env/account?)
what does “apply” actually mean here — is it gated or does it just… do it?
do we get a real audit trail (tool calls, diffs, approvals) and can we replay/debug?
what happens when it’s unsure: does it stop or guess?
drift + partial failures: does it fail safe or make it worse?
If you’re building one, the guide maps those questions to concrete patterns (PR-based flow, explicit boundaries, logging/replay, blast radius limits, stop conditions).
davletdz•1h ago
AI is being used actively for infra already today, but the knowledge is still scattered. Every infra team I talk to is re-discovering the same stuff: what permissions to give, how to keep changes reviewable, how to audit what happened, what to do when the agent is wrong, and how not to end up with “LLM + admin role” in production.
If you’re buying an agent, use it like a checklist:
can we run it read-only and keep it that way?
how does it get creds (short-lived? scoped? per env/account?)
what does “apply” actually mean here — is it gated or does it just… do it?
do we get a real audit trail (tool calls, diffs, approvals) and can we replay/debug?
what happens when it’s unsure: does it stop or guess?
drift + partial failures: does it fail safe or make it worse?
If you’re building one, the guide maps those questions to concrete patterns (PR-based flow, explicit boundaries, logging/replay, blast radius limits, stop conditions).
Blog context: https://blog.cloudgeni.ai/why-we-open-sourced-our-infrastruc...
Guide repo: https://github.com/Cloudgeni-ai/infrastructure-agents-guide/
If you’ve tried agents near prod and backed away, I’m curious what tripped the wire.