Let an AI Agent Author Policy-as-Code, Never Override Its Verdict
Fourteen new MCP tools let an agent create, dry-run and manage IaC pull-request policies. The two withheld tools are the ones that bypass the gate.
Riya Mittal
Riya is an AI engineer at ZopDev, working on production LLM pipelines behind the company's content and account-intelligence platforms. She works on the engineering that makes these systems reliable and repeatable, from multi-provider orchestration and structured output validation to evals, idempotent pipelines, and automated recovery. She writes about what it takes to make AI systems reliable enough to run in production.
A Write Tool for an AI Agent Needs Four Gates and One Audit Trail
ZopNight's MCP catalogue grew from 122 tools to 275, with 83 new writes. Every write clears four gates that can each refuse alone, across three tiers.
FinOps Custom Rules Needed the Right Band, Not Just a UI
A built-in rule library only covers what's common across enough customers to be worth shipping. FinOps is the practice of giving engineering, finance, and product teams shared, real-time visibility…
The Layout Problem 68,000 Developers Have Hit
The HStack left-center-right alignment problem is not a niche edge case. It is a layout trap that 68,526 developers walked into and had to search their way out of (Stack Overflow, question 70776006).…
ZopDay Puts Idle VM Services to Sleep, Cuts Waste
A service deployed on a VM used to run continuously, holding its full memory allocation whether one visitor showed up that hour or none did. That's the default assumption most deploy paths make: a…
ZopNight's Audit Trail Logs Assistant Reads for Compliance
An AI assistant connected to your infrastructure through MCP reads far more than it writes. It checks a resource's state, looks up a cost figure, or lists a team's permissions many times over for…
ZopDay Hardens Auth Before Shipping Its IDP Install Link
Getting a teammate to install a specific app used to start with a conversation, not a click: open ZopDay, find Starter Templates, search the catalog, find the right chart, then start the flow. Every…
ZopNight's MCP Server Enables Cloud Governance for AI Agents
An MCP server sits between a platform and every AI client that talks to it: Claude, Cursor, Codex, and anything else built against the Model Context Protocol spec. When that spec moves forward, the…
FinOps Schedule Recommendations Now Show Evidence, Not a Guess
A single fixed 50KB threshold decided whether a resource counted as "quiet." Every account got the same number, regardless of that resource's own traffic. That definition quietly broke. Schedule…
FinOps Severity Now Ranks Right-Sizing by Real Savings
A recommendations engine that flags idle resources, orphaned volumes, and right-sizing opportunities usually assigns severity by rule type: every idle-disk finding is "Medium," every…
The Bill Nobody Signed Off On
Cloud bills do not lie, but they do surprise. The $28,000 per month in shadow compute charges that accumulated without a single approval signature is not an anomaly. It is the predictable output of a…
ZopDay's Kubernetes Chart Diff Skips the Changelog
The chart version a service is running is usually a guess. A team imports a Helm release or installs something from a catalog, and the chart version stays whatever it was on day one until someone…
The 3 AM Problem No Runbook Fully Solves
Static runbooks fail at 3 AM not because engineers write them poorly, but because incidents refuse to follow the sequences those runbooks assume.
ZopNight's Kubernetes Fixes Outweigh the New Feature
ZopNight's newest release notes open with a new feature: you can now migrate a database from one GCP Cloud SQL instance to another without leaving ZopDay, the Kubernetes platform ZopNight ships…
The Problem With AIOps That Stops at 'Act'
Most AIOps implementations treat the "Act" phase as the finish line, and that architectural choice turns automated remediation into a liability rather than a guarantee.
The Credit Cliff: Why Free Tiers Create a False Sense of Cost Security
Free cloud credits do not reduce your infrastructure costs. They defer them, invisibly, until expiration forces a full-price reckoning on a codebase that was never designed with billing in mind.
A Resource Your Tags Cannot See Is a Resource Your Rules Cannot Touch
Tags are the join key of cloud governance.
A Search Box That Only Sees the Current Page Is Not Search
A search box that filters only the page you are on is not search, it is a per-page filter wearing search's clothes.
The Illusion of Resolution: When Green Dashboards Lie
A green dashboard is not proof of a healthy system. It is proof that your automation closed a ticket. Those two outcomes are not the same thing, and conflating them is how engineering teams…
A Cost of Zero Can Mean Free, or Mean Nobody Priced It
A resource that shows a cost of zero is telling you one of two very different things.
The Governance Wall: When Infrastructure Scale Breaks Manual Policy
Manual policy enforcement breaks at infrastructure scale because the number of enforcement decisions grows faster than the number of resources. A team managing 50 resources reviews policy by…
An Alert Should Tell You What Changed, Not Just That It Did
Most cloud alerting fails two ways: silent on the events that mattered, or so noisy you stop reading it.
A Six-Hour Scan Misses What the Audit Log Already Caught
Cloud inventory has a blind spot nobody notices, because you cannot see what it never recorded.
Raw LLM Keys Are a Blank Check. An AI Gateway Is the Front Door.
Most teams adopt LLMs the same way: someone creates a provider API key, pastes it into a service, and ships. It works, so it spreads. Six months later there are a dozen raw keys across a dozen repos,…
Why Multi-Account Policy Enforcement Breaks Down at Scale
Ad-hoc policy management breaks down precisely at the point where account count and resource sprawl outpace human review cycles. Below 50 resources across two or three accounts, a shared spreadsheet…
A Stopped Azure VM Is Not a Free One
Deallocating an Azure VM feels like turning off the meter. The compute charge does stop. What most teams miss is that the VM's attached managed disks and its reserved public IP keep billing, at full…
Namespaces Are the Tenancy Line. Your Cluster View Should Respect It.
In Kubernetes, the namespace is where multi-tenancy actually lives. Resource quotas stop there. Network policy stops there. RBAC stops there. Then someone opens a live cluster view and sees every…
The Imported Service Was a Black Box. Now It Has a Front Door.
When you provision a service through ZopDay, you get its whole story: configuration, live status, and how to reach it. When you
The Illusion of a One-Time Cloud Cost Win
Cloud cost optimization fails because teams treat it as a project with a finish line, not a process with a heartbeat. The moment a team declares victory after a reservation purchase or a rightsizing…
One Deploy, One Failure, One Very Large Bill
A single bad deployment cost $180,000 not because the deployment was uniquely catastrophic, but because nothing in the system was configured to stop it from spreading (ZopDev, "Blast Radius by…
The Alert-Only Trap: Why Notifications Aren't Enough
Alerting is not remediation. That gap between "alert fired" and "system restored" is where reliability erodes and costs accumulate.
The GUI Trap: Why Developers Keep Reaching for the Terminal
GUI tools for developer workflows carry a hidden tax: every click, every modal, every context switch compounds into lost focus that terminal-native engineers refuse to pay.
The Dashboard Illusion: Visibility Without Action
Watching a dashboard is not the same as reducing a bill. This distinction sounds obvious until you audit a team that has spent six months perfecting their cost visualization and still cannot explain…
What Launch Week Taught Us: Cloud Waste Is an Ownership Problem
We launched ZopNight on Product Hunt and Indie Hackers. The rankings were nice. The real lesson was that idle spend survives because no one owns it.
The Observability Trilemma: Features, Cost, and Complexity
Every cloud-native team building observability at scale hits the same three-way constraint: you cannot simultaneously maximize platform capability, minimize cost, and keep operational complexity low.…
Cloud Waste Doesn't Die in a Dashboard. It Dies in the Backlog.
Detecting cloud waste is the easy half. Every cost tool produces a list of idle instances, oversized volumes, and forgotten load balancers. The list is not the problem. The problem is that the fix…
Your Cloud Doesn't Need More Tags. It Needs Derived Ones.
Cost attribution has one dependency that quietly breaks it: every resource must be tagged correctly, by the engineer who created it, at the moment they created it, forever. That does not happen.…
The Alert That Arrives Too Late
Transient P99 latency spikes self-resolve before alerting systems surface them, and that gap is where the most dangerous incidents hide.
The Azure AI Estate Is the Blind Spot in Your Cloud Bill
AI is the fastest-growing line on the cloud bill and the least governed. Cost tools were built for VMs, disks, and load balancers. They see an Azure OpenAI deployment, an AI Search index, or an Azure…
Databricks Spend Crosses Clouds. Governing It Shouldn't Stop at Two.
Databricks is one of the largest and most opaque line items on a data team's cloud bill. It is also one of the few that genuinely spans clouds: the same platform runs on AWS, Azure, and GCP, often…
The Two Numbers Most FinOps Teams Confuse — or Ignore
Most FinOps teams track one number when they need two, and that single blind spot turns cost governance into a cleanup exercise instead of a control system.
Cloud Budgets Belong to Accounts, Not Resources
A budget only works when it lands on something a person can own. Most cloud budgets do not. They sit on a single resource or a resource group, objects that no team fully owns and no engineer checks…
The Deployment That Looked Like Savings
Cost-cutting deployments fail SLOs not because engineers are careless, but because infrastructure assumptions are invisible until load exposes them.
AWS Databricks FinOps: Flagging Idle Isn't Stopping It
A flagged idle Databricks cluster keeps billing until something stops it. ZopNight now governs AWS Databricks end to end: discover, cost, recommend, and stop.
The IDP Bill: $180k/Year in Hidden Platform Toil
Most engineering organizations budget precisely for building an Internal Developer Platform and budget nothing for operating one. The build cost is visible: headcount, tooling licenses, sprint…
AWS Bedrock Is an Estate, Not an API: FinOps for GenAI
AWS Bedrock cost is not token spend. It is an estate of agents, models, provisioned throughput, and jobs, each billed differently and easy to miss.
Self-Healing Infrastructure: 4 Runbooks We Deleted After Automating Them
Every runbook your team executes manually is an open automation ticket that nobody filed. That is the central problem. The runbook library is not documentation. It is a backlog in disguise, and most…
ZopNight Is Coming to Product Hunt: An Operating System for Everything Your Cloud and AI Run
ZopNight launches on Product Hunt soon. A Technology Value OS that ties every cloud, AI, and SaaS resource to its owner, its cost, and whether it still earns its keep.
The Alert You See Is Not the Problem You Have
OOMKill is a reporting artifact, not a root cause. By the time the kernel logs the kill event and your alerting pipeline fires, the service already degraded for every user who hit it in the preceding…
Phantom SageMaker Bills: FinOps by Run Duration, Not the Month
A finished SageMaker job that still shows a monthly charge corrupts your forecast. ML needs run-duration costing for jobs and idle rightsizing for endpoints.
Setup once, ask forever: wiring Claude Fable to your cloud cost via ZopNight in 5 minutes
AI assistants now connect to cloud cost infrastructure in 5 minutes, transforming how engineering teams query spending data. Claude Fable wires to cloud cost data via ZopNight in 5 minutes (ZopDev…
The $180,000 Promise: Unpacking Self-Service Platform ROI
Platform vendors claim $180,000 in saved engineering hours (The Self-Service Platform Bill), but this figure collapses under basic scrutiny because it omits the platform's operational cost, the ramp…
Blast Radius Before Execution: Why Autonomous Cloud Must Check Idle Resources First
Autonomous cloud remediation fails the same way every time. The recommendation is correct. The action is correct. The scope is wrong.
Kubernetes MTTR: From 43 Minutes to 9 With Structured Runbooks
Kubernetes MTTR: From 43 Minutes to 9 With Structured Runbooks The median Kubernetes incident takes 43 minutes to resolve. Eight minutes of that is the actual fix. The other 35 minutes is engineers…
Cost Flow: A Sankey Diagram for Where Your Cloud Spend Actually Goes
A FinOps lead opens AWS Cost Explorer to answer the question the CFO asked yesterday: where is our cloud spend going. The first view is a stacked bar chart of monthly cost by service. EC2 is the…
ZopDev MCP Server: 7 Typed Tools for Claude, Cursor, and Codex
A developer asks Claude Code at 2 AM: "this terraform plan is failing admission, fix the bucket so it deploys." Claude reads the error, generates a slightly different bucket config, runs the plan…
Cost Per Customer for SaaS: The Unit Economics Dashboard That Killed Three Pricing Mistakes
Finance computes cost per customer as once per quarter. The number is mathematically correct and operationally useless. A B2B SaaS at $8/customer/month sounds healthy until you look at the…
Chargeback Without Spreadsheets: The 4-Field Schema That Replaced Our 200-Tag Mess
The tag taxonomy starts at 30 keys and climbs from there. Year one, every team agrees on , , , . Year two, finance asks for , , , . Year three, the security team adds , the platform team adds , and…
FinOps Right-Sizing Without Vibes: The 5-Number Recipe That Cuts $200k of Idle EC2
The average mid-size production EC2 fleet runs at 12 to 23 percent utilization. The remaining 77 to 88 percent is idle compute that ran continuously, billed continuously, and produced nothing. On a…
Kubernetes CPU Throttling Is Lying to You: Why Container Limits Bleed Latency
The dashboard says CPU throttling is at 0.5%. The p99 latency on that container says 30% of requests just lost 80 milliseconds to scheduling delay. Both numbers are correct. They are measuring…
Closed-Loop IAM Remediation: Auto-Fixing Security Misconfigurations Without a Human in the Loop
The average time to remediate an IAM misconfiguration in ticket-driven teams is 14 days. The fix takes 4 minutes. The DERA loop — Detect, Evaluate, Remediate, Audit — closes the gap automatically. Here's the full AWS architecture.
eBPF Gives Kubernetes Full Network Visibility Without the Sidecar CPU Tax
Istio sidecars cost 0.5 vCPU per pod at idle. At 100 pods, you're paying for 50 idle vCPUs. eBPF moves observability into the kernel — one hook point per node, not per pod. Here's the architecture, the tools, and when you still need Envoy.
Golden Paths That Include Cost Guardrails: A Platform Engineering Playbook
Every service provisioned from a Backstage template starts with zero budget alerts, zero mandatory tags, and a dev environment that runs 24/7. The platform team didn't choose this — they just never added cost defaults to the template. Here's how to fix that.
ZopNight v2.0: The Control Layer Your Cloud Bill Has Been Missing
Most teams treat cloud waste as a reporting problem. It isn't. ZopNight v2.0 ships the full four-layer control stack: discovery, policy, audit, and action — across AWS, GCP, and Azure.
Serverless FinOps: Why Lambda Cost Models Break Every Assumption You Learned from VMs
Most teams apply VM cost intuition to Lambda and end up paying more, not less. This covers the real billing math, the memory-speed paradox, the cold start trap, and the framework for deciding when Lambda wins.
Cloud Configuration Drift: How Silent State Changes Become Expensive Incidents
Configuration drift is the gap between what Terraform declares and what runs in production. AWS Config detects it in 15 minutes. Most teams find it in 72 hours. Here is how to close that gap.
AWS Control Tower vs. Custom Landing Zones: Which Governance Model Actually Scales
Most teams pick their multi-account governance model the wrong way. Here's a technical breakdown of AWS Control Tower vs custom landing zones — guardrails, Account Factory, SCP structure, and when each model actually scales.
Closed-Loop Cloud Remediation: How Autonomous Policies Replace On-Call Runbooks
The average remediation event takes 47 minutes in runbook-driven ops. The fix takes 4. Closed-loop remediation eliminates the overhead — here's the full technical architecture and how to start with your first policy.
Backstage Costs More Than You Budgeted: The Real Platform Engineering ROI Calculation
Teams adopt Backstage for developer experience but few measure what it costs to run. This breakdown covers hosting, staffing, plugin rot, catalog hygiene overhead, and when the ROI actually makes sense.
ZopNight Ships VM Autoscaling, MCP Server, and Tag-Level Cost Attribution
Most cloud platforms tell you what happened. They do not fix it. This release moves ZopNight from a visibility layer into an execution layer — VM autoscaling across 3 clouds, 43 read-only AI tools, tag-level cost attribution, and more.
How We Cut AWS NAT Gateway Costs by 52%
NAT Gateway silently compounds costs through $0.045/GB processing fees and cross-AZ charges. We reduced our bill from $4,200 to $2,016/month with two targeted fixes — per-AZ gateways and free VPC endpoints.
Kubernetes VPA vs HPA vs KEDA: Which Autoscaler Actually Cuts Your Bill
The average Kubernetes cluster runs at 13% CPU utilization. VPA, HPA, and KEDA each attack the 87% idle gap differently — here's which one cuts your bill and which one creates production incidents.
Databricks All-Purpose Clusters Are Draining Your Budget. Switch to Job Clusters.
All-Purpose Compute costs 2.7x more than Jobs Compute for the same hardware. Learn how to audit your Databricks workspace, migrate scheduled pipelines to job clusters, and eliminate idle spend.
Azure Diagnostic Settings Are Shipping Your Logs Twice. Here's the Fix.
Your Log Analytics workspace is probably ingesting duplicate data right now. Azure's diagnostic settings model has three specific patterns that silently produce duplicate ingestion. Here's how to detect and fix each one.
Developer Productivity Metrics: What to Measure and How to Improve Them
Story points and PR counts measure activity, not outcomes. Here's how to use DORA and SPACE metrics to understand what's actually slowing your team down and what to fix first.
Automated Cloud Scheduling Non Prod Environments
Your non-prod environments ran all weekend and were billed for every hour. Here's the case for automated scheduling, how it works in Kubernetes, what breaks, and how teams recover 60%+ of idle cloud spend
The Advantages of Fixed Pricing Over Charging Per Pod in Kubernetes
Per-pod pricing turns maxReplicas into a cost dial and punishes autoscaling. Here's why fixed per-environment pricing lets Kubernetes work the way it was designed and what that means for reliability.
The Complete Guide to Cloud Networking Costs: VPCs, NAT Gateways and Data Transfer
Most cloud networking costs hide in "EC2 - Other" for months. Here's exactly what you're paying for across NAT Gateways, cross-AZ traffic, and VPC endpoints, and the fixes that take under an hour.
How to Detect and Fix CPU Throttling in Kubernetes (And Why It's Costing You)
Most teams discover CPU throttling only after p99 latency spikes and costs climb. Learn how to detect it in minutes using PromQL and fix it by right-sizing your CPU requests and limits.
The Hidden Mechanics of Cloud Scaling: What Every Developer Should Know
Cloud scaling isn't magic, it's a deliberate process. Learn how provisioning, networking, and health checks impact performance and how to design better systems.
Get the weekly in your inbox.
One post a week. Sundays. No "10 ways to think about cloud" listicles, just the engineering and FinOps notes we'd want to read.