Cole Medin on the permission pattern he uses so AI coding agents can operate real infrastructure without holding the keys — a ~2-minute spotlight, sponsored by Kestra (their 2.0 just shipped; the core stays Apache-2.0).

Why trust breaks at the boundary

  • He has used coding agents to write every line of code this year — but still monitors and validates everything
  • The limiter isn’t the model, it’s what the agent can reach: the moment it touches real infrastructure you hand it a cloud key, a database URL, shell access — everything, including the ability to wipe the database

The fix: an orchestrator between the agent and the infra

  • Wrap the coding agent in an orchestrator that gives it workflows to do the things you want — and nothing more
  • Operations are written once as YAML in Git; the agent never gets access to the credentials the orchestrator uses
  • The agent simply receives a list of workflows it is allowed to invoke, and credentials are used inside those flows — “that is the entire permission model”

What the permission surface looks like in practice

  • The example agent can restart services and scale replicas — nothing else
  • Flows are plain YAML files defined alongside the agent, so everything is manageable in Git

Observability is what makes unattended runs OK

  • Every call comes back as a normal execution with inputs, logs, and results visible in the dashboard
  • When agents run without you, you can still open and read what they did

Open source

  • Kestra 2.0 is officially out; the core is Apache 2.0, and the AI-agent piece is part of the open-source core, not behind an enterprise paywall

“What limits my trust is not the model itself — it’s what it can reach.” — Cole Medin