Two years ago the question was whether to let engineers use LLMs on infrastructure work. That’s settled. The question now is where the human sits in the loop, and I’ve come to a fairly firm answer: the agent can hold the keyboard, and the human holds the merge button. Every time.
What I actually rolled out
Across delivery engagements at Ollion I drove team-wide AI adoption: NotebookLM as a shared project knowledge base (so a distributed team across time zones can ask the docs instead of asking a person at 1am), Agentspace to pull the scattered tools into one place, and Claude Code, Codex, and Gemini for IaC and automation scripting.
The rule I set on day one: review discipline unchanged. Same PR template, same reviewers, same policy checks, same “explain the blast radius” comment on anything touching prod. If a Terraform module came out of a model or out of a person, it hit the same gate.
The teams that struggle with AI adoption, in my experience, aren’t the ones that adopt too slowly. They’re the ones that quietly lower the review bar because “the model wrote it, it’s probably fine”. Six weeks later they’re debugging a security-group rule no one remembers approving.
The agentic version
I’m now prototyping something more ambitious: an agentic migration factory on Claude Opus. Agents do discovery, generate migration plans and Terraform, and open pull requests. Humans review and approve. No one hand-writes the IaC or fills in the discovery forms.
It’s early, and I’m not going to oversell it. But the design decision I’m most confident in is the boundary: authorship is delegated, accountability is not.
Why the boundary is a guardrail
Three reasons this is the right shape for infrastructure specifically:
Blast radius is asymmetric. A bad function is a bug. A bad IAM binding is an incident. When the downside is that skewed, a cheap human check on the last step is the best trade in the system.
Agents fail confidently. They’ll produce a plausible resource block with a subtly wrong region, or a policy that’s syntactically perfect and semantically open to the world. Confident and wrong is exactly the failure mode reviewers are good at catching and models are bad at self-catching.
Prompt injection is real for ops. An agent that reads a ticket, a README, or a cloud console page can be told, by that page, to do something. If the agent can act without approval, whoever writes the page can act as you. Approval-only closes that door.
What this looks like in practice
Treat agent output like a junior engineer’s PR from someone you haven’t worked with yet. Read it. Run the plan. Check the diff against the intent, not against “does it look like Terraform”. Keep the policy-as-code checks in the pipeline so the boring violations never reach a human.
And measure. If the agent’s PRs are getting rejected 40% of the time for the same reason, that’s a prompt or a tool problem, and it’s your job to fix it upstream rather than absorb it in review.
I use these tools daily. I didn’t build them, and I don’t think the interesting engineering is in the model anyway. It’s in the shape of the loop around it.