IaC Automation: From Local Scripts to AI-Governed Platforms
In 2022, the challenge was moving Terraform from laptops to pipelines. In 2025-2026, the challenge is governing infrastructure generated by autonomous AI agents (Claude 4, GPT-4o, CrewAI, AutoGen). In other words, these agents write, plan and apply changes in seconds. In fact, at BAOSS IT consulting we have seen clients go from 14 days to 4 hours in deployment lead-time. However, we have also seen teams lose control of drift, costs and security by delegating to LLMs without guardrails.
This article does not review tools —the 2022 post already did that—. Instead, it describes five platform capabilities that separate the organizations that scale IaC with AI from those that accumulate invisible technical debt. Moreover, each capability includes real metrics from BAOSS projects (anonymized, Q1 2024 – Q1 2025).
1. Dynamic RBAC with policy-as-code (Policy-as-Code 2.0)
The static RBAC of 2022 (who can run terraform apply) is no longer enough. In fact, in 2025, a LangGraph agent can generate 50 PRs per hour modifying modules, workspaces and providers simultaneously. You need policies that evaluate runtime context: estimated cost, blast radius and compliance tags. Therefore, those policies are evaluated before the plan, not after.
- BAOSS case (retail, 12 AWS accounts): We implemented OPA Gatekeeper + Kyverno on Spacelift with Rego rules generated by GPT-4o from PCI-DSS documents. Result: 92% of PRs blocked in < 3 min for mandatory tagging violations, a key control when AI agents write infrastructure, as we cover in the risk of AI agents; zero critical findings in the Q4 2024 external audit.
- Key metric: 68% reduction in manual security review time (from 4.2 h/PR to 1.3 h/PR).
2. Self-hosted runners with workload isolation (Zero-Trust Execution)
IaC SaaS platforms (env0, Scalr, Spacelift Cloud) are convenient. However, in 2025 73% of our enterprise clients (banking, public sector, healthcare) require that secrets, state and code never leave their network. The solution is not a generic “self-hosted runner”: it is ephemeral fleets on Kubernetes (EKS/GKE/AKS) with Kata Containers or gVisor, provisioned by Cluster API. Moreover, we register them via MCP (Model Context Protocol) so that AI agents (Claude 4, local Ollama) can request capacity just-in-time.
- BAOSS case (banking, 40 clusters): Migration from GitHub Actions self-hosted to GitLab + ephemeral K8s runners with vLLM serving local plan-review models. Runner cost/hour: EUR 0.12 vs EUR 0.45 SaaS; plan latency p95 = 38 s (previously 2 min 17 s).
- Key metric: 3.2x ROI in 6 months (license savings + lower MTTR for secrets incidents).
3. AI-augmented PR planning (Speculative Plan + AI Diff)
The 2022 “PR plan” showed terraform plan in a comment. Now, in 2025, the diff is generated by a RAG agent that indexes historical state, provider schemas and internal runbooks. This way, the agent answers in natural language: “This change exposes port 22 to 0.0.0.0/0 in prod-db-sg; it violates rule SEC-04; estimated cost +EUR 187/month”. Thus, the developer accepts, rejects or requests an alternative without leaving the PR.
- BAOSS case (logistics, 200 repos): Integration of Atlantis + LangGraph + ChromaDB (vector store of 12k historical plans). False positives in review: 3% (previously 22% with static rules); average time to merge: 1.8 h (previously 6.4 h).
- Key metric: 40% reduction in failed production deployments (from 12/month to 7/month).
4. Distributed state management with State Backend Federation
In other words, a single S3 + DynamoDB backend does not scale when autonomous agents (AutoGen, CrewAI) run 300+ concurrent plans against 500+ workspaces. Federation enables logical sharding by domain (network, compute, data) with eventual consistency and lock-free reads for plan. Finally, optimistic locking only kicks in on apply. For example, we implement it with Terraform Cloud/Enterprise or OpenTofu + etcd.
- BAOSS case (telco, 1,200 workspaces): Migration to Spacelift Stacks + federated backend. Plan throughput: 1,800 plans/hour (previously 320); lock contention zero during release windows.
- Key metric: Nightly deployment window reduced from 6 h to 55 min.
5. Unified observability: the Drift → Incident → Remediation loop closed
In 2022, drift detection was a cron sending an email. In 2025, drift opens an incident in PagerDuty/ServiceNow and enriches it with AI root-cause (GPT-4o analyzes plan vs state). Then it triggers auto-remediation via Runbook Automation (RBA) if policy allows it. Moreover, we trace everything in OpenTelemetry and correlate it in Grafana Tempo.
- BAOSS case (e-commerce, 800 critical resources): Drift detected → incident → remediated in < 9 min p95 (previously 4.2 h manual). Furthermore, we recorded zero SLA incidents from drift on Black Friday 2024.
- Key metric: Drift MTTR 97% lower; 1.2 FTEs freed for platform engineering.
Capabilities summary 2025-2026 vs 2022
| Capability | 2022 (Original article) | 2025-2026 (BAOSS reality) |
|---|---|---|
| RBAC | Static roles | Dynamic OPA/Kyverno policies + AI |
| Runners | Generic self-hosted | Ephemeral K8s fleets + MCP + vLLM/Ollama |
| Plan PR | terraform plan comment |
RAG semantic diff + conversational agent |
| State | Single backend | Sharded federation + lock-free reads |
| Drift | Cron + email | Closed Drift→Incident→Auto-Remediation loop |
The difference is not the tool —Terraform/OpenTofu, Pulumi, Crossplane remain at the base—. Ultimately, we are talking about the intelligent automation layer that governs, accelerates and audits every change made by humans or by AI agents (Claude 4, GPT-4o, CrewAI, AutoGen, LangGraph).
Thus, at BAOSS we design, implement and operate that layer for clients who no longer ask “which tool should I choose?”. Instead, they ask “how do I scale IaC with AI without losing control or sleep?”. That is why we tell you how to choose an AI technology partner that answers both.
Need help from BAOSS IT consulting? Write to us at https://baoss.es/contacto/
Prefer to talk to us directly? Contact the BAOSS team and tell us about your challenge.