Agents Pick Up Bad Habits
They learned from public tutorials and copy your repo’s old patterns, not your approved instance types, tag standards or security baselines.
Agentic Infrastructure Code Governance
Every agent ships infrastructure code that follows your FinOps, security and tagging policies by default.
Works with Claude Code, Cursor, GitHub Copilot and Codex
Coding agents generate Terraform and Kubernetes manifests in seconds. Without your policies in the loop, they generate waste and risk just as fast.
They learned from public tutorials and copy your repo’s old patterns, not your approved instance types, tag standards or security baselines.
Deploy, flag, ticket, redeploy. Findings show up days after the code shipped, and tickets pile up on platform, FinOps and security teams.
Docs are written for people to interpret. Agents need exact rules, scoped to where the code runs, and policies locked in other tools never reach them.
Your agents get your policies before they write a line. Anything that slips through gets fixed automatically, in the pull request or in the running cloud.
Stacklet Skills and MCP give the agent the FinOps, security and tagging policies already deployed to the accounts it’s writing for. It checks what applies before it writes, so new code meets today’s standards even when the repo doesn’t.
Every change is checked against your policies at pre-commit, pre-merge and pre-deploy. When something’s off, the fix goes back into the diff, so reviewers get a compliant pull request, not a list of problems.
Console changes, drift and idle resources never pass through a pull request. Stacklet catches and fixes them automatically in the cloud, down to the pod. Need a new rule? Describe it to Jun0 and it’s enforced at every stage.
Cloud Custodian policy language, 10+ years in production
name: ec2-approved-families
resource: aws.ec2
filters:
- not:
- type: value
key: InstanceType
op: regex
value: "^(m7g|c7g|r7g)\\."
actions:
- type: stopSKILL.md
name: stacklet:guardrails
description: Apply when writing infrastructure code
before_writing: stacklet.get_policies(target_account)
rules:
- Use m7g, c7g, or r7g families
- Max size xlarge without an exception
- Volumes: gp3, never gp2
- Check cost with stacklet.get_pricingget_policies target: aws / prod-payments
Policies in effect56
get_pricing, list price in us-east-1
Agentic infrastructure code governance is the practice of making AI coding agents follow an organization’s infrastructure policies, across cloud, Kubernetes and AI infrastructure, when they write infrastructure code like Terraform and Kubernetes manifests. It puts FinOps, security and tagging rules in front of the agent before it writes, instead of finding violations after deployment.
IaC scanning checks infrastructure code after it’s written. Agentic code governance works earlier, giving coding agents your policies before they write, so the first draft already follows your FinOps, security and tagging rules. Stacklet does both. Its shift-left IaC policy enforcement finds issues in infrastructure code and fixes them automatically, and the same policies guide your agents and keep enforcing in the running cloud. One policy engine, from the first line to production.
Stacklet works with Claude Code, Cursor, GitHub Copilot and Codex through Stacklet Skills and the Stacklet MCP server. It covers Terraform and other infrastructure as code languages, Kubernetes manifests, and runtime enforcement across cloud accounts and Kubernetes clusters, down to the pod.
No. The agent asks Stacklet which policies apply to its target account and resource types, and Stacklet returns the rules. Your code stays with the developer’s coding agent.
No. Agents use the same Stacklet policies you already run in production, built on open-source Cloud Custodian. One set of policies guides the agent while it writes and enforces in the cloud after deploy, so there’s nothing new to maintain.
aws_s3_bucket.exportshas no server-side encryption. Policy s3-encryption-required.storage.tf