Giving an AI agent access to production infrastructure is a great way to move fast — and a great way to have it drop a database because a prompt was ambiguous. I wanted the upside without the footguns, so I built a family of Model Context Protocol servers that share one safe-by-default governance model.
The problem
MCP lets an agent call tools. For infra, those tools can be delete_topic, DROP TABLE, delete_resource_group. The usual answer is "just don't expose the dangerous ones" — but then the server isn't useful when you do need them. I wanted graduated, explicit control instead.
The governance model
Every server shares the same layered policy engine:
