Context
Once agents were reviewing code, the next question was whether they could help diagnose and fix infrastructure. Reading cluster state is useful. Changing it is where the risk lives.
The problem
Giving an agent kubectl access is a permissions problem disguised as an AI problem. An agent with cluster-admin is an unbounded blast radius, and the failure mode is not malice, it is a confidently wrong action taken quickly. The design had to make the dangerous path narrow and observable rather than trusting the model to be careful.
- step: Agentdiagnoses an issue
- step: Read-only MCPcluster state
- step: Proposed planintended change
- control: RBACnamespace scope
- control: PR approvalhuman
- result: Appliedscoped mutation
Approach
- 01
Split read from write at the server boundary
A read-only MCP server answers questions about cluster state. Mutating operations live behind a separate, namespace-scoped server. An agent that only needs to diagnose never holds a capability that can change anything.
- 02
Scope by namespace, enforced by RBAC
The mutating server binds to specific namespaces through Kubernetes RBAC. The limit is enforced by the cluster, not by the agent's instructions. A prompt cannot talk its way past a role binding.
- 03
Require a plan before an action
Changes are proposed as a reviewable plan rather than applied directly, so the intended effect is visible before anything happens.
- 04
Gate execution on pull-request approval
A human approves the change through the same review path as any other infrastructure change. The agent accelerates the work; it does not shorten the control path.