The public site in this factory argues, at length, for human-gated agentic governance. Then it had to go to production, and go-live day is precisely when such arguments get quietly suspended: the finish line is visible, the human is excited, and “just this once” is the most reasonable sentence in engineering. So the launch itself was the honest test of whether the gate was a practice or a decoration.
The Infrastructure Gremlin (the factory’s infrastructure agent, whose contract is plan-but-never-apply) prepared the launch: wrote the Terraform for a private object store behind a CDN with certificates and DNS, ran init, validate, and plan. Thirteen resources to create, nothing to change, nothing to destroy. Then its own plan-summary classifier looked at the plan and flagged it RED.
The false positive that proved the gate
The RED was wrong, in the narrow sense: it fired on a bucket-ownership-controls resource missing from the lab’s allowlist, a benign best practice, not a danger. The agent could see that. And this is the moment that decides what your governance actually is, because the agent had everything it needed to reason “false positive, proceed anyway”, and an agent that can talk itself past its own safety check on launch day has no safety check.
The contract held instead: the agent does not apply, full stop, and a RED classification is recorded, not adjudicated by the thing it flagged. The classification went into the deploy manifest, the apply and the runbook went to the human, and the human, having reviewed the plan, ran the apply. The site went live the same day, through the gate, with the false positive documented rather than overridden.
The split that survives contact with launch day
The interesting design is not “a human approves things”; it is which things. The same go-live session drew the line deliberately, in both directions.
Infrastructure stays behind the plan-then-human-apply gate forever: anything Terraform touches is create-and-destroy authority, so the agent proposes and classifies, and a human applies. When the launch surfaced a real gap minutes later (subdirectory paths returning errors, because a private origin does not resolve directory indexes), the fix went through the same loop: a small CDN function, planned, reviewed, applied in place by the human.
Content deploys got the opposite treatment, on purpose. Push to main builds, checks, syncs files, and invalidates the CDN cache, automatically, authenticated by short-lived OIDC credentials with a least-privilege role and no stored keys. That is real authority handed to automation, and it is handed exactly where a bad push cannot destroy anything: the worst case is wrong content, which the next push fixes.
The part worth stealing
Draw your own three-column split before your next launch, and pressure-test it with one question per action: what is the worst thing this authority can do on its worst day? Authority whose worst case is recoverable (content, cache) can automate on evidence. Authority whose worst case is destruction or exposure stops at a human, and launch day is the day that rule earns its keep, because that is the day everyone, agent included, has the best-sounding reasons to waive it.
What Next
The Infrastructure Gremlin That Plans But Never Applies
Coming in Governance Without Killing the Joy: the agent contract behind this launch, and why plan-but-never-apply is a role worth designing on purpose.