Solutions · Use case
Coding agents & cloud changes
Give coding agents room to work, and a checkpoint before they touch production.
Typical agents
Coding agents and infrastructure automation
Systems touched
Repositories, CI/CD, cloud consoles and secrets stores
Who approves
Platform engineering and security
The risk
What can go wrong
Coding agents run commands, change infrastructure and handle credentials. The productivity is real; so is the blast radius of a destructive command or a leaked secret.
Production changes without review
A coding agent with deploy rights can change production infrastructure as easily as it edits a test file.
Credential exposure
Agents that read environment files or secrets stores can copy credentials somewhere they should never be.
Destructive commands
A misread instruction can drop a database or delete a bucket in seconds.
Typical decisions
How GREENLIGHT typically decides
Each action an agent proposes gets one of four outcomes, with a reason a reviewer and an auditor can read.
| Agent action | Typical outcome | Why |
|---|---|---|
| Read code and run tests | Allow | Reading code and running tests changes nothing outside the workspace. |
| Change production infrastructure | Require human approval | Production infrastructure changes need an engineer to approve. |
| Access or move credentials | Escalate | Credential access is unusual and goes to a person. |
| Destructive command on a protected system | Block | Destructive commands on protected systems are not allowed. |
Illustrative. Outcomes follow your policies and thresholds.
One action, end to end
An infrastructure change, end to end
What happens between the moment an agent decides to act and the moment your system changes. Figures are illustrative.
- 1Coding agent
A coding agent proposes applying a change to a production network configuration.
- 2GREENLIGHT
The pre-action hook sends the command to GREENLIGHT; production changes need approval.
- 3Platform engineer
An engineer reviews the planned change and approves it.
- 4GREENLIGHT
The approved command runs once; a different command needs a new decision.
- 5Logbook
The change is on the record alongside every other agent action.
How GREENLIGHT governs it
Four parts of the platform, working together
Each part of GREENLIGHT plays a role in this use case. Follow a link to see how that part works.
Integrate
Hooks for Claude Code, Cursor and agent frameworks.
Connect any agent, without rip-and-replaceDecide
Each command or change evaluated before it runs.
Evaluate every consequential actionEnforce
Production changes held for approval.
Act on the decision — and only on the decisionEvidence
Every agent action on the record.
Prove what happened, to anyone who asks
The difference
Without GREENLIGHT, and with it
| Without a decision point | With GREENLIGHT | |
|---|---|---|
| Production changes | Possible whenever the agent has the rights | Approved by an engineer first |
| Secrets and credentials | Readable by any agent in the environment | Access escalated and recorded |
| Destructive commands | Executed if the agent decides to | Blocked on protected systems |
Rollout
Start in shadow, enforce when you are ready
For this use case, as for every other, GREENLIGHT starts by watching. Nothing is blocked until you decide it should be.
Shadow
GREENLIGHT evaluates every action and records what it would have decided. Nothing is blocked, so you can measure before you change anything.
Advisory
Decisions are returned to the agent and to your teams as recommendations, and policies are tuned against real traffic.
Enforce
Holds and blocks are switched on workflow by workflow, starting where the risk is highest and the evidence is clearest.
Get started
Start with this workflow.
Bring one Coding agents & cloud changes workflow into GREENLIGHT in shadow mode. We will show you what it would decide on your real traffic, then agree with you when to enforce.