AI Coding Guardrails

Your coding agent can propose infrastructure changes. It should not decide when they are safe to ship.

This practical course and tested repository help DevOps, platform and cloud engineers use Claude Code, OpenAI Codex and Gemini CLI with one shared control model: explicit repository instructions, executable acceptance criteria, least-privilege tools, plan-only Terraform, deterministic CI and human production approval.

The result

Turn an open-ended AI task into a bounded change with a reproducible finish line. Show what the agent could access, which checks passed, which findings remain and who owns any later apply or deployment.

What is included

• Eight implementation modules and four guided labs
• A canonical repository contract for Claude Code, Codex and Gemini CLI
• Executable task acceptance and findings-ledger validators
• Secret-path preflight and risky-command hook examples
• MCP inventory and cross-vendor tool-permission matrix
• A local-only Terraform lab with format, validate and saved-plan checks—never apply
• GitHub Actions and GitLab CI quality-gate examples without production credentials
• Implementation workbook, 25-case test catalogue and troubleshooting runbook

Built for real DevOps failure modes

Use the lab when agents miss acceptance criteria, multiple reviews fail to converge, a repository contains risky secret paths, or an MCP integration exposes more tools than the task needs.

Four hands-on labs

1. One contract, three agents: keep shared rules in one canonical file.
2. Terraform without apply: produce validation and plan evidence without cloud credentials.
3. Convergent multi-agent review: deduplicate findings and enforce a stopping rule.
4. MCP and secrets boundary: inventory tools and prove secret-like paths fail the preflight.

Who it is for

Individual DevOps, platform, cloud and infrastructure engineers; technical founders; freelancers; and small technical teams that already understand Git and basic CI/CD or Terraform.

What it does not do

The package does not deploy cloud resources, include credentials, guarantee compliance, replace IAM or certify AI output as safe. The included guardrails are defense in depth. You remain responsible for testing, change control and production decisions.

Requirements

• Git, Bash and Python 3.9+
• Optional Terraform 1.5+ or OpenTofu 1.6+ for the full IaC exercise
• Optional Claude Code, Codex or Gemini CLI access for tool-specific practice

Need an organizational rollout? Scope an AI Coding Agent Readiness Assessment.