Rules and Approvals
A platform team writes the rules once and every request obeys them, whether it came from a person in the console, a script on the CLI, or a coding agent at two in the morning.
For the platform team that writes the rules once, and the leader who wants to know they held.
What You Get
Shipped behavior, stated as it works today. The record beside it is the shape of what the product stamps; its figures are examples.
Deployment Budgets
An environment can carry a deployment budget. A deploy whose verified cost exceeds it pauses for a human decision, and who approved, when, and why is stamped on the record.
Protected Environments
A change to a protected environment is a request: an approver reads the exact plan the engines previewed, and only that plan applies. Nobody approves work they initiated, the assistant included.
A Curated Catalog
The catalog can be curated to the catalog kinds your organization allows. The console, the CLI, and the agent all see the same list and refuse the same things, because one answer serves both.
Secrets Stay Secret
A field the schema marks sensitive takes a managed secret. There is no way to type a raw secret into it.
Deploy paused
requested by
coding agent, on behalf of s.rao
environment
prod · protected · budget $250/mo
verified cost
~$312/mo est.
verdict
over budget by ~$62/mo · paused for a decision
who may approve
anyone with approve access on prod · never the requester
resolution
approved by a.patel · 2026-09-17 09:14 · “the replica is intentional”
An illustration of the record the product shows. Figures marked est. are examples; a real record carries its own.
What We Will Not Say
The words this page holds itself to, so a reviewer does not have to find the over-claim.
- These are the rules that ship today. A rule over the content of a configuration (“no public data stores in production”) is not one of them yet, and this page does not pretend it is.
- Only creation is governed by catalog curation. Updates, redeploys, and destroys of what already exists are never blocked, so disabling a kind can never strand live infrastructure.
- A pause is a pause for a person. Nothing here approves itself.
Read Next
The Record
Every infrastructure change is one Infra Job, kept and queryable with its configuration, cost fact, verdicts, approvals, and the snapshot of what exists afterward.
What It Proves →Verified Before Deploy
Before anything is created, Planton states the monthly cost with its coverage, the least-privilege permissions, and the controls each kind enforces.
What It Proves →