How I added a deterministic trace contract to an AI Terraform reviewer so rejected infrastructure changes stop before the model is invoked.

I recently built an AI-powered Terraform review agent that combines Terrascan, GitHub Actions, AWS Lambda and Gemini.

The workflow is straightforward:

A pull request changes Terraform code.

GitHub Actions runs Terrascan.