Private data
Databases must not be publicly accessible. Production storage must be encrypted and have backups enabled.
Your policies control agent autonomy.
Latifold is designed to evaluate proposed changes with deterministic rules before applying them. The coding agent can suggest a repair, but it cannot override a failing policy.
Make the boundaries explicit.
Humans set accounts, budgets, agent permissions and change rules. These examples describe governance design, rather than a claim that every policy integration is shipped.
Approved scope
Only approved regions, resource types and sizes may be used. Agents receive narrowly scoped authority.
Sensitive operations
Production deletion and estimated cost increases above a threshold require an authorised person's approval.
Your agents propose.
Your rules decide.
Humans set accounts, permissions, budgets and approval rules. Latifold is designed to evaluate changes with deterministic policies before execution. An agent can propose a correction; it cannot override a denied policy.
- Approval belongs to a plan
- Tie approval to the exact plan, configuration and policy revision. Revalidate when the plan or relevant environment changes.
- Cost estimates have limits
- An estimated cost increase can trigger approval. Actual spending limits need separate runtime enforcement; an estimate is not a hard budget guarantee.
- Record the actual outcome
- Keep agent identity, human authorisation, provider results and verification together. Surface concurrent changes, partial failures and unresolved drift.
Authority follows the source of truth.
Read-only observation does not grant permission to remediate. Existing IaC owners remain authoritative.
Observed
Read-only discovery, diagnostics and recommendations. Latifold does not automatically correct these resources.
Externally managed
Terraform, OpenTofu, CloudFormation, CDK or another owner stays authoritative. Proposed changes go through its existing review and deployment workflow.
Latifold-managed
Latifold's versioned desired state is authoritative. Authorised changes use native cloud APIs and controlled reconciliation within the agreed scope.
A decision your agent can act on.
Allow
The proposed work passes the applicable rules.
Warn
An advisory finding needs to remain visible in the plan.
Require approval
A permitted operation waits for an authorised reviewer.
Deny
Execution is blocked until the proposed change satisfies policy.
Each result should identify the policy, affected resource, explanation and suggested correction. Missing security-critical data must not silently count as compliance. Changed plans or relevant environment state must be revalidated.
Keep the record.
Keep the claims precise.
Designed audit records connect the initiating agent and human authorisation to the exact plan, policy revision, provider execution and verified outcome. Partial failure and drift remain visible.
Controls need implementation evidence.
Policy engines and scanners remain candidates until their integrations are verified. No comprehensive compliance certification, universal policy coverage or guaranteed zero-downtime operation is claimed.
Estimated cost approval thresholds are distinct from actual spending controls, which require separate runtime enforcement.
Keep coding. Bring your cloud into the workflow.
Give your coding agent context on existing infrastructure and the ability to make changes within your permissions and policies. Changes proceed automatically unless your rules require approval.