Terraform infrastructure control

Plan-only passed. Auto-approve and workspace deletion stopped.

A real agent requested Terraform operations against HCP Terraform. Routed through Writ, the Charter allowed a speculative plan while denying auto-approve execution and workspace deletion before those requests reached Terraform.

Full narrated walkthrough will be added after recording.

1. Plan-only run authorized
1. Plan-only run authorized The Charter permitted a speculative plan. Writ forwarded the request and HCP Terraform completed the run without applying infrastructure changes.
2. Real Terraform plan produced
2. Real Terraform plan produced HCP Terraform generated a real plan showing one resource to create and no resources to modify or destroy.
3. Authorization receipt in HCP Terraform
3. Authorization receipt in HCP Terraform The run receipt recorded the authorized decision, forwarded status, verified trust chain, and the dangerous actions denied during the same session.

Final run

The recorded session allowed a plan-only operation and denied auto-approve execution and workspace deletion. The denied requests were not forwarded to HCP Terraform. Chronicle recorded the session and Seal verified the resulting evidence.

Stipul governs only calls routed through Writ. Direct Terraform API access, unmanaged CLI or SDK calls, leaked credentials, compromised hosts, and bypass paths remain outside this demonstration's control boundary.