Harrison Halperin

Designer & builder

Automating Cloud Cleanup

“The agent plans, a human destroys”

Read-only evidence gathered into a destruction plan for orphaned cloud resources; a human operator still performs the delete.

Pro
AI governancePolicy as codeTerraform

Harrison Halperin

Project brief

Shipped

Problem

Cloud cleanup is risky when an agent can act directly on shared infrastructure.

Outcome

Nothing in this tool can destroy anything. Orphaned Terraform Cloud resources get a signed, dependency-ordered destruction plan built from read-only evidence. A human operator performs the delete.

Evidence

  • The inversion is the point: “agent runs the cleanup” becomes “agent writes a verified destruction plan.” The bundle carries a schema-validated manifest, dependency-ordered scripts, policy results, and an operator narrative, sealed with an HMAC so any tampering shows on verify.

Key decisions

  • Evidence zone: Terraform Cloud, GitHub, and AWS are read through wrappers that can only list and describe, never destroy.
  • Planning zone: Risk classification and a dependency graph decide what's safe to include and in what order.
  • Seal zone: The bundle is HMAC-signed. Any tampering after the fact shows on verify.
  • Boundary: The agent's responsibility ends at the seal. A human operator or audited workflow performs the delete.

The inversion

I inverted the usual cleanup story: instead of an agent running the cleanup, the agent writes a verified destruction plan. The bundle carries a schema-validated manifest, dependency-ordered scripts, policy results, and an operator narrative, sealed with an HMAC so any tampering shows on verify. Determinism does the trust work: the same frozen inputs produce the same artifacts, so a reviewer reads a reproducible plan rather than a transient agent output. The agent-never-destroys boundary is enforced in depth with read-only client wrappers, tool-level hooks, and policy gates, not just a prompt that asks nicely. Terragram is the generative IaC sibling on the create path. Scripts judge; agents propose matches the same split: here the agent writes the plan and never destroys.

Evidence to sealed bundle

The first figure follows the bundle from read-only evidence to a sealed, human-executed plan. The second walks the phase pipeline that produces it.

  1. 01
    Read-only evidence
    Terraform Cloud · GitHub · AWSnothing written yet
  2. 02
    Risk classify
    safe · coupled · high
  3. 03
    Dependency graph
    topological sortsets destroy order
  4. 04
    Policy checkGate
    OPA + Sentinel
  5. 05
    SealGate
    HMAC-signed bundleagent's role ends here
Boundary — agent ends, human begins
  1. 06
    Human executes
    operator or audited workflow

The agent's responsibility ends at the seal. A human operator or an audited workflow performs the delete.

The phase pipeline

  1. 1Collect evidence
  2. 2Classify risk
  3. 3Map dependencies
  4. 4Check driftplan vs. live
  5. 5Apply policyGate
  6. 6Write + sealGate

Each phase reads the last one's output. A dependency cycle aborts the run rather than emit a partial bundle.

Chain of custody

Evidence zone
Terraform Cloud, GitHub, and AWS are read through wrappers that can only list and describe, never destroy.
Planning zone
Risk classification and a dependency graph decide what's safe to include and in what order.
Seal zone
The bundle is HMAC-signed. Any tampering after the fact shows on verify.
Boundary
The agent's responsibility ends at the seal. A human operator or audited workflow performs the delete.

Skills manifest

01
AI governance

Propose vs apply stays separated so cleanup agents cannot destroy on trust alone.

02
Policy as code

Eligibility rules for Automating Cloud Cleanup live as reviewable policy code, not slide decks.

03
Terraform

Destruction bundles propose cleanup; apply stays gated and reviewable.

04
Cloud automation

Automating Cloud Cleanup codifies cloud operations so provisioning and remediation stay repeatable.

05
Security

Destructive apply paths assume mistakes; proposal and apply stay separated.

06
AWS

Automating Cloud Cleanup runs on AWS primitives (compute, data, and IAM treated as coded infrastructure).

07
Agentic

Agents propose destruction bundles; humans decide what actually applies.

08
Schemas

Inventory and bundle payloads are schema-validated before review.

09
OPA

OPA-style policy decides which cloud resources are eligible for authored destruction bundles.

Related work

WorkTerragramWritingNobody should both write and mergeWritingLet the scripts judge and the agents fix

Portfolio graph

Hover nodes · click empty canvas to zoom/pan

Maps how the work here connects. Open the Portfolio graph →

  • Professional
  • Personal
  • Skill
  • Writing