Whether the Terraform is hand-written by a senior engineer or generated by an autonomous agent, the failure mode does not change. The gap is always the missing approver.
The vendors keep getting the boundary right — auth, transport, secret exposure. The approver record is the part that has always been ours to build. It sits one layer above the boundary, inside the change-control process, and no tool ships it for you.
When Terraform replaced hand-built infrastructure, the question was which named human accepted the risk of the change. The author is an agent now instead of a junior engineer. The question is identical.

Valdemar

A practitioner reflecting on infrastructure auditing across banking, telecom, and cloud-native environments argues that the core governance gap — the missing approver record — remains constant regardless of whether Terraform is written by humans or AI agents. The change-control layer above the technical boundary (auth, transport, secrets) is never shipped by vendors and must always be built by the organization. The author's point: as AI agents replace junior engineers as Terraform authors, the accountability question stays identical — which named human accepted the risk of the change.

I audit infrastructure across banking, telecom, and cloud-native environments today