Compliant by Design: An Agentic Workflow for Platform Code (Late 2025)

The old way: an engineer writes a Terraform module, opens a pull request, and a reviewer finds the missing tags, the bucket without encryption, the name that breaks the convention. Back and forth, three rounds. The new way: by the time a human sees the change, the tags are there, the encryption is on, the name follows the convention, the tests pass, and the security scan is clean. The review is about the design, not the basics.

That's what "compliant by design" means. In late 2025, I started delivering platform code this way, with an AI agent doing much of the writing.

From snippets to a workflow

Until now, AI had been a helper I talked to. An agent is different: it can read files, write code, run commands, and check its own results, in a loop, until a task is done.

That's powerful, and risky. An agent that writes code fast can also write non-compliant code fast. So the question changed from "what can the agent write?" to "what must every piece of code pass before anyone accepts it?"

Rules first, then the agent

I built the workflow around the rules, not around the agent:

1. The standard comes first. Naming, tagging, module structure, and the security baseline are written down, and the agent reads them before it starts.
2. The agent writes the change, following the standard.
3. Automatic checks run: format, lint, security scan, tests, and a plan with no surprises. If anything fails, the agent fixes it and runs them again.
4. A person reviews it: the design, the risk, and anything the checks can't judge.
5. A person approves the deploy. The plan is shown on the pull request, and nothing is applied until someone approves it.

Three things make it work:

1. The standard is written down. Naming, tagging, module layout, and security rules live in the repository, where the agent reads them first. The Terraform track describes the kind of standard I mean: base and composition modules, naming and tagging, and module testing.
2. The checks are automatic. Linting, security scanning such as Checkov, and terraform test run on every change. The agent runs them too, before it says it's done.
3. A person still decides. Every change goes through review, and nothing is applied to an environment without a person approving it, the same promotion gate any engineer's code goes through.

Review gets better, not just faster

• Fewer review rounds. The basics are already right, so reviews focus on design and risk.
• More consistent code. The agent follows the standard every time. People forget; written rules don't.
• Standards got sharper. When the agent did something odd, the cause was usually a gap or an unclear line in the standard. Fixing the standard fixed it for every future change.

Responsibility

The agent writes much of the code, but I'm responsible for what gets deployed. A clean scan doesn't prove a design is right. A passing test only checks what someone thought to test. That's why the human review and the approval gate stay, however good the agent gets.

If you're at this stage

• Write the rules before you let the agent write code. An agent amplifies whatever standard it's given, good or missing.
• Automate every rule you can. Checks don't get tired, and they don't skip steps under deadline pressure.
• Keep the human gate. Agents speed up delivery. They don't take over accountability.

Quick check

Next: Chapter 08. February 2026, AGENTS.md, Skills, and MCP.