New workloads used to mean a custom AWS build and a ticket pile. Now app teams describe the work. Agents write against the platform standard. A human merges.
This is a production workflow for enterprise cloud changes: hours, not a project. Agents propose. Humans merge. The cloud is last.
IT, Security, Networking, and FinOps used to show up at the end. Standards drifted. We were the bottleneck. App teams waited on a custom AWS build for every new workload. Now they state what they need. Five specialists share one change against a forked platform template. Git is the only write.
The contract
Nothing reaches the cloud because an agent felt done. The change has to survive a pull request, executable gates, and a person on merge.
01 · The control loop
The contract: agents propose, humans merge.
Intent never reaches the cloud. The only mutation is a pull request.
Propose
01IntentPlain-language request
02Context packSkills + durable memory
03AgentsSpecialists propose
04Structured changeTerraform as code
Govern
05Pull requestThe only write
06Executable gatesPlan · lint · policy · cost
07HumanApprove and merge
Ship
08CloudOnly after merge
××
Never skip the pull request
Never terraform apply
Agents propose
They read live context and schema, then write a structured change into git. They do not execute against the cloud.
Gates then humans
fmt, validate, plan, TFLint, Checkov, policy, cost, and CI run on the pull request. A human approves.
The cloud is last
Merge is the only path that ships. Any arrow that skips the pull request is a defect, not a shortcut.
The contract: agents propose, humans merge. Intent never reaches the cloud. The only mutation is a pull request.
Five specialists, one change
Every team used to reinvent networking, encryption, IAM, and CI. They fork a platform template instead, so the secure foundation is already there. Control-team rules ride in the context pack, not in a late review.
02 · System map
Cloud Engineer Agent.
A forked platform template in. An auditable pull request out. MCP is read-only.
Intake
Engineer + template
EngineerRequests work against a fork.
Forked platform templateAlready in the template:
Private network
Encryption
Naming and tags
Least privilege
OIDC CI / CD
Specialists
Five agents, one change
PlanningScope the change.
ImplementationWrite Terraform.
ValidationCheck the plan.
DocumentationExplain the change.
ReviewCritique before the PR.
Context pack · every agent
Skills / instruction filesPlus durable memory from four desks
Security Approved OS / runtimes, encryption.
Networking Hub-and-spoke, private connectivity.
Architecture Patterns the template encodes.
FinOps Cost posture the gates will check.
Tool bus
MCP · read, never write
One-way · agents read through MCP · write only to git
MCP
Schema · Terraform MCP Current provider and resource schema.
Live state · AWS MCP Live account and resource context.
Output · the only write
Auditable pull request
Never terraform apply.
On merge: architecture diagrams and lessons return to the base template.
Adjacent · not these agents. Admin portal: unstructured requests become JSON, then deterministic services (invites, seats). Landing-zone vending is a separate orchestrated pipeline. Agents do not replace it.
A forked platform template in. An auditable pull request out. MCP is read-only.
How a change runs
Request in. Pull request out. Fail, and the loop iterates on the gap. Pass, and a human ships. After merge, diagrams and lessons go back into the template so the next app starts stricter.
03 · Runtime
Cloud Engineer Agent · runtime.
Request in. Pull request out. Merge returns diagrams and lessons to the template.
Engineer
Agent coordinator
MCP
CI
Human
passfail · iterate
01RequestForked template
On mergeLessonsBack to the template
02PlanScope the change
03Generate TerraformStructured change
05Open pull requestThe only write
04MCP readsSchema + live state
06Executable gatesfmt · plan · lint · policy
07ApproveOn pass
08MergeShip
01
Engineer
RequestForked template
02
Agent coordinator
PlanScope the change
03
Agent coordinator
Generate TerraformStructured change
04
MCP
MCP readsSchema + live state
05
Agent coordinator
Open pull requestThe only write
06
CI
Executable gatesfmt · plan · lint · policy
07
Human
ApproveOn pass
08
Human
MergeShip
On merge
Engineer
LessonsBack to the template
Request in. Pull request out. Fail iterates. Pass goes to a person. Merge returns diagrams and lessons to the template.
Cloud scaled. Adoption scaled. The ticket queue did not. If AI does not change how the company ships infrastructure, it is a demo.