Cloud ops behind a digest

Human gate: Approval bound to a digest, rechecked at execution · Stack: Python · FastAPI · MCP · React · CloudFormation · Seed species: Cobalt

Problem

An agent is useful in a cloud account for exactly the reasons it is dangerous there: it reads fast, it acts fast, and it does not hesitate. The aim was an agent that can read freely and change nothing without a person approving the precise change.

How it works

The console runs on 127.0.0.1 only. One agent dock drives the account through 17 MCP tools.

Every result comes back redacted and wrapped as untrusted data, so text inside a resource cannot act as an instruction. Any write becomes an approval card. The person’s decision is bound to a digest of exactly what the card showed. At execution the digest is recomputed and the deny tags are checked again; anything that does not match fails closed. Every step goes to an append-only, hash-chained audit log.

A resource tagged as hard-denied is refused twice: by the app, and by IAM. Production boxes always wait for a click. In the DevOps flow a change has a 50 dollar cap, two rule engines check it, and a production change needs its stack name typed out. The agent has no execute tool of its own.

Method

The gate was proven on a throwaway instance that lived about ten minutes, never against anything real. A wrong digest returned 409. An approved stop ran. An approved snapshot was created. A hard-denied target returned 422 from the app and was refused by IAM as well.

A security run followed: three blind code reviews in parallel, 83 black-box probes, and an IAM policy simulation that cost nothing.

Results

• About six cents a chat turn; eight for a turn with an approval.
• Fast gate 12.3 seconds; 274 Python tests and 17 front-end tests.
• Cost Explorer limited to one call a day.

What broke

With one setting meant to cut background traffic, a turn started before the tool servers were ready. The model had no tools, did not say so, and wrote a tool call and an invented result as plain text. Nothing ran. The relay now flags fabricated calls.

Tool-result previews were cut at 600 characters, so the approval id fell past the cut and the card never appeared. A second message on a running conversation made the first unstoppable for 14 minutes.

The security run found a role the DevOps flow could build that trusted another account, a policy rule that NotAction slipped past because an empty list passes every check, and a cost cap that counted a failed estimate as zero dollars. All fixed.

Limitations

One owner, one account. Logs are read only through Logs Insights, under a cap. The managed account is shown here only through throwaway evidence.

Next

Retire the old access keys, then a blind second-model review of the whole console.