AI-assisted and agentic tools now generate, plan, and sometimes apply infrastructure changes with minimal human input, and 93% of organizations have already experienced an AI-caused infrastructure incident despite 76% saying they'd apply AI-generated Terraform (HCL) with little to no review. A five-layer guardrail model is proposed spanning before generation (golden modules, private registries, policy as code, agent configuration), review (mandatory PRs, CODEOWNERS, static analysis like Checkov/Trivy/KICS, secret scanning, cost checks, labeling), apply (single delivery path, approval gates, scoped short-lived agent identities, deny-by-default on destructive operations, sandboxing), post-apply (drift detection, session logging, AI-specific metrics, post-incident feedback loops), and an organizational AI usage policy. Spacelift's platform (blueprints, OPA policies, RBAC, drift detection, audit trails, and its Intelligence features like Intent and Infra Assistant) is presented as implementing these controls.
Table of contents
1. Before generation2. At review3. At apply4. After apply5. The organizational layerWhere and how to start?Questions this post answers
What percentage of organizations have had an AI-caused infrastructure incident?
93% of organizations have experienced at least one AI-caused infrastructure incident, according to the Spacelift 2026 Infrastructure Automation Report. Despite this, 76% of infrastructure teams say they would apply AI-generated HCL (Terraform code) to production with minimal or no review, and a third would skip review entirely. daily.dev surfaces guardrail practices for teams weighing how much to trust AI-generated infrastructure code.
What is slopsquatting and why does it matter for AI-generated infrastructure code?
Slopsquatting is a supply chain attack where an AI model hallucinates a plausible but nonexistent package or module name, and an attacker registers a malicious package under that exact name; the next automated run then installs the malicious code. Mitigations include pulling only from internal registries, pinning dependencies with lockfiles, and blocking unapproved installs behind an allowlist or human approval. Developers securing AI coding workflows can track emerging supply-chain risks like slopsquatting on daily.dev.
How should organizations set autonomy levels for AI agents managing infrastructure across environments?
A practical approach ties agent autonomy to environment sensitivity: in sandboxes and ephemeral environments agents can apply changes on their own, in staging they can open pull requests that a human merges, and in production they only suggest changes while a person owns review through apply. This tiered model limits blast radius while still letting AI speed up lower-risk work. Teams deciding how much autonomy to grant coding agents can compare governance approaches on daily.dev.