Infrastructure as code for agents

Infrastructure-as-code describes the environment an agent runs in (model endpoints, vector store, queues, secret references, IAM roles, guardrail configuration, monitors and on-call services) as versioned files. The tool compares those files with its recorded state and with reality, produces a plan, and applies only what the plan says. Reproducibility comes from three habits: one set of modules for every environment, with differences confined to small reviewed input files; remote, locked, encrypted state that never holds secret values; and every plan checked by policy and read by a human in the pull request before production changes.

• The plan is the unit of review, not the code diff.
• State is a secrets-bearing database. Encrypt it, lock it, restrict it, and keep secret values out of it.
• Environments differ by inputs, never by copy-pasted code.
• Policy as code turns the customer's guardrails into failing checks before apply.
• Drift means production changed outside the pipeline. Find out why before you touch it.