ZopNight for Platform Engineers: Guardrails as Code and APIs
A platform team does not want another console. It wants cost and policy checks inside the pipeline, the tagging model and the agent tooling it already runs.
A platform engineering team is accountable for the internal platform: the templates, pipelines, access model and defaults that product teams build on. A good platform means those teams rarely have to think about infrastructure policy. For cost, that means the checks belong in the paved road itself, at plan time, at tag time and at the API, rather than in a monthly review.
Policy at plan time
IaC governance is a policy engine over your own Terraform and OpenTofu: it reads plan output in pull requests and show -json state for inventory scans. It ships builtin rules across eleven categories, each tagged with frameworks such as CIS, SOC 2, HIPAA and FinOps, and accepts custom Rego run in real OPA, sandboxed with no network or clock. Cost guardrails such as maximum monthly cost or maximum cost delta print the monthly figure in the PR. ZopNight is the decision point only; your GitHub required check enforces, and ZopNight never runs apply. The CI onboarding endpoint mints a scoped scan token and opens a PR that adds the GitHub Action to the repository. Scans also match declared resources against discovered inventory, separating managed resources from orphans.
A tagging model that fills its own gaps
Tagging policies derive a tag value from a resource’s own fields (provider, region, type, instance type or name). Many policies can share one key as a decision table, so an imported sheet of “name contains” rules can populate an Application tag. Derived tags stay pending until accepted, are auto-accepted where they already match the live cloud tag, and can be written back to the cloud on demand. See tagging best practices.
An API for agents, with write access off by default
The MCP server exposes resources, schedules, costs, recommendations, budgets, audit logs, autoscaler, event readiness and policy tools to Claude Code, Claude Desktop, Cursor and Codex, authenticated by personal access token. Write access is opt-in per organization in tiers: none (the default), metadata-only, reversible and irreversible, with the last also requiring an org-bound token. A global kill switch keeps the write surface off. Role and member management sit at tier 1 and bulk start and stop at tier 3, while organization and cloud-account deletion, credential reads and org-level role assignment are never exposed at any tier. Every call, reads included, is audit-logged. See setting up MCP for Claude.
An access model that mirrors the cloud
Custom roles scope each policy to specific resource IDs, and team members act only on their team’s resources. Cloud IAM Import proposes users, groups and roles from AWS, GCP and Azure for review; nothing applies until an admin clicks Apply, and organization-management grants are never auto-imported.
Kubernetes defaults
Namespace-level stop and start, one implementation across EKS, GKE and AKS, skips system namespaces at both the UI and executor layers. Kubernetes workload rules flag missing requests and limits, single replicas, privileged containers and unbound volumes. See Kubernetes workload rules.
Questions we get a lot.
If yours isn't here, email us and we'll answer directly.
Can an AI agent delete resources through ZopNight's MCP server?
Only if an admin raises the organization's write tier to irreversible and the agent uses an org-bound token. Every organization starts with no write access, and the global write switch ships off.
Does IaC governance need access to our Terraform state backend?
It evaluates the plan or show -json output your CI job produces, using a scoped scan token minted during CI onboarding.