Guardrails
Nothing reaches your cloud until a person reads the diff.
At a glance
What Guardrails gives you.
Policy on every plan
Rules over networking, identity and data protection read the real plan and refuse it before anyone is asked to approve.
Approval bound to the plan
The approval is tied to the plan’s digest. What was approved and what is applied cannot drift apart.
Destructive changes need more
Approving a plan that deletes something is a separate permission from approving one that creates.
An append-only record
Who asked for what, who approved it, and what changed, in one log that is added to and never edited.
In detail
How it works.
Policy
Rules that read the plan, not a description of it.
Policy runs against the machine-readable plan Terraform produced. A security group open to the internet, an unencrypted volume, a database with a public address or a resource without an owner tag is refused with the rule and the resource named.
- Network, identity and data protection rules included
- Runs on create, change and destroy plans alike
- A refused plan explains itself in plain language
Approval
An approval anyone on the team can give with confidence.
Changes are grouped by what they are for, networking, compute, data and access, with the cost beside them. The person approving types a confirmation, and the approval is bound to that exact plan.
- Grouped, plain-language diff with the raw plan available
- Typed confirmation for anything that deletes
- Approval recorded against the plan digest
Permissions
Roles that match how a small team actually works.
Permissions are checked on the server on every request and read fresh each time, so removing someone’s access takes effect on their next click rather than at their next login.
- Deny by default on every route
- Separate permissions to plan, approve and approve destructive changes
- Roles you can define, archive and audit
Questions
Common questions about Guardrails.
- Can the assistant apply a change on its own?
- No. Nothing reaches a cloud from model output. The assistant produces a proposal, which becomes a plan, which policy checks and a person approves.
- Can we add our own policies?
- Yes. The included rules cover networking, identity and data protection, and your workspace can add rules of its own that run on every plan.
Keep reading
The rest of the platform.
See your own infrastructure as a plan.
Tell us about your team and the cloud you use. We will set up your workspace and walk through your first plan with you.