The problem
Agents went from occasional helpers to daily tools quickly. Everyone used them a bit differently. Some people let an agent run commands in a shell with production credentials, some wouldn't let it near anything. There wasn't a shared rule.
How I measured it
# which repos have agent instructions at all?
for r in $(gh repo list my-org --limit 200 --json name -q '.[].name'); do
gh api "repos/my-org/$r/contents/AGENTS.md" >/dev/null 2>&1 \
|| gh api "repos/my-org/$r/contents/CLAUDE.md" >/dev/null 2>&1 \
|| echo "no agent instructions: $r"
done
# applies run from anything other than the pipeline (CloudTrail, by user agent)
aws cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false \
--max-results 50 --query "Events[].CloudTrailEvent" --output text \
| jq -r '.userAgent' | sort | uniq -c | sort -rn
Why it kept happening
The tools moved faster than the habits around them. Without a written rule, each person drew the line in a different place.
The process change
A short policy, kept in each repo as agent instructions, and enforced by the pipeline where it could be:
- Agents can read, plan and propose.
terraform plan, tests, linting, drafts of postmortems. - Humans approve and apply. No agent has credentials that can apply to production.
- The PR shows the effect: the plan's create, change, replace and delete list next to the code diff.
- Repo instructions capture lessons: when an agent gets something wrong, the instruction that would have prevented it gets added.
What I learnt
The rules for agents ended up the same as the rules for a new engineer: propose, show the effect, get a review. Writing them down made agents easier to use, because people stopped worrying about where the line was.
What I do now
- Agents plan, humans apply. Enforce it with credentials, not trust.
- Keep agent instructions in the repo, and add to them after every miss.
- Put the plan's effect in the PR so the review is about real infrastructure.
if you're bringing AI agents into infrastructure work → page me