The Policy-as-Code Decision That Doesn't Bite You Until Later
The policy-as-code choice between OPA and Cedar feels low-stakes at ten accounts. It stops feeling that way at 500.
Notes from the team building the autopilot.
Post-mortems. Benchmarks. The kind of FinOps detail you actually need before you run the migration. One post a week, no fluff.
ZopNight Is Coming to Product Hunt: An Operating System for Everything Your Cloud and AI Run
ZopNight launches on Product Hunt soon. A Technology Value OS that ties every cloud, AI, and SaaS resource to its owner, its cost, and whether it still earns its keep.
Every AI Assistant Needs Its Own Grant and Its Own Audit Trail
A pasted access token is identical in every assistant that holds it. OAuth consent gives each one its own revocable grant, scoped to the orgs you pick.
A FinOps Recommendation Queue Needs One Non-Terminal State
Apply, dismiss and close all resolve a finding. Bookmarking is the state that says not yet, and it only works if the filter is resolved server-side.
Let an AI Agent Author Policy-as-Code, Never Override Its Verdict
Fourteen new MCP tools let an agent create, dry-run and manage IaC pull-request policies. The two withheld tools are the ones that bypass the gate.
A Write Tool for an AI Agent Needs Four Gates and One Audit Trail
ZopNight's MCP catalogue grew from 122 tools to 275, with 83 new writes. Every write clears four gates that can each refuse alone, across three tiers.
OpenShift Belongs in the Same Kubernetes Inventory as EKS and AKS
ROSA is invisible to the AWS APIs that discover EKS, so it drops out of inventory and every policy inventory feeds. One cluster list fixes that.
A Token Should Declare Intent and Let IAM Decide at Call Time
ZopNight removed the frontend gate blocking capabilities your role lacks. Enforcement was always at the gateway, so the decision moved to call time.
A FinOps Finding Going Quiet Is Not Proof It Was Fixed
ZopNight re-reads the resource a finding fired on before closing it. All 264 rules that can raise a recommendation now carry a verification path.
Tag Detection Is Not Tagging Governance Until You Write It Back
Tag apply on AWS went from 21 resource types to 36. The work was refusing to build an ARN the platform could not prove pointed at the right resource.
The Hidden Cost of Ephemeral Records
Cost history must outlive the resource that created it. That principle sounds obvious until you watch a deleted API key take three months of spend attribution with it into the void.
FinOps Custom Rules Needed the Right Band, Not Just a UI
A built-in rule library only covers what's common across enough customers to be worth shipping. FinOps is the practice of giving engineering, finance, and product teams shared, real-time visibility…
The Bill That Belonged to No One
Unattributed cloud costs are not a budgeting failure. They are a visibility and ownership failure, and $60,000 in untagged egress charges proves the point (ZopDev, "The Egress Bill Nobody…
Get the weekly in your inbox.
One post a week. Sundays. No "10 ways to think about cloud" listicles, just the engineering and FinOps notes we'd want to read.