Pipeline request
Your GitHub Actions or GitLab step asks for production authority.
Governance for agentic pipelines
Let agents ship infrastructure faster. Keep every change governed and tracked.
When agentic workflows change Terraform or CDK through GitHub Actions and GitLab, Control9 applies policy, approvals, and an audit trail so speed does not mean flying blind.
Getting started as a team
Platform leads start a Control9 team with a work email or Google (Google Workspace). Teammates your admin invites can sign in with any email address on that invite, including personal addresses when that is the invited email. GitHub is for installing the Control9 Action in CI, not for signing into the admin app.
How it works
Risk check
Control9 classifies what the Terraform or CDK change actually does.
Govern
Policy allows, observes, or requires approval before deploy continues.
Track
Approvals, deploy proof, and off-path signals stay on one timeline.
Example: production IAM change
An agent or developer expands an IAM role in Terraform. The pipeline sends Control9 the plan summary and fingerprint before apply can use production authority.
What happens next
- Flag riskIAM expansion is treated as high-impact.
- Require proofApprove in enforce mode, or observe in shadow mode.
- Verify deployConfirm the shipped artifact matches what was reviewed.
- Catch bypassesConsole or unmanaged mutations show up as off-path.
Why teams add Control9
Speed with guardrails
Agentic pipelines keep moving. High-impact changes still get policy and approval.
Proof that lasts
Approvals and deploy outcomes live outside ephemeral CI logs.
Your pipelines stay yours
Keep GitHub Actions, GitLab, Terraform, and CDK where they already run.
Agentic pipelines, governed delivery
Agents can move fast. Production still needs a paper trail.
Control9 is not an AI agent and does not write your Terraform or CDK. It sits on the pipelines those agents already use so every high-impact change gets policy, approval when required, and tracking you can show later.
Use cases
Agentic pipelines at speed
Let agents ship faster with governance and tracking still on.
Governed Terraform / OpenTofu
Approve the plan that actually reaches production apply.
Governed CDK / CloudFormation
Review template risk without moving deploy off your pipeline.
Deploy verification
Confirm the approved artifact is the one that deployed.
Approval evidence
Keep who approved what after job logs are gone.
Off-path detection
See production mutations that skipped the governed path.
Ready to assess your pipeline?
Start with a two to four week shadow-mode assessment. Production deploys continue while you review ranked findings before enabling enforce mode.