Learning to trust an AI coding agent with real infrastructure, one permission at a time
Going into Week 2 of the DMI DevOps Micro Internship, I assumed I already understood what an AI coding assistant does: you type a prompt, it writes some code, you review it. What I actually learned this week is that Claude Code isn't a text generator you talk to; it's an agent operating inside a system of guardrails, and understanding those guardrails turned out to be the real curriculum.
1. Biggest technical insight I got this week
The concept that reframed everything for me was the agentic loop: read context, plan, call a tool, observe the result, decide the next step, repeat until done. That loop is powerful, but it's only safe because of what wraps around it.
In the project I worked on, CLAUDE.md tells the agent upfront that the site is pure HTML/CSS with no JavaScript and no build step, so it doesn't waste a turn inventing a bundler or npm scripts that were never there. Layered on top of that are skills: reusable slash commands like /scaffold-terraform and /tf-plan that turn a long, easy-to-forget prompt into a single, repeatable action, each with its own declared allowed-tools.
That's where tool restrictions stopped being an abstract "best practice" and became something I could point to. The tf-plan skill is scoped to Bash, Read, Grep, deliberately no Write, because a plan should only observe infrastructure, never change it. settings.json reinforces the same philosophy at the project level: it explicitly allows read-only Terraform and AWS calls (terraform plan, aws s3 ls, aws sts get-caller-identity) and explicitly denies destructive ones (rm -rf *, aws iam *). Permissions, I realized, aren't bureaucracy bolted onto AI, they're the actual mechanism that makes it safe to hand an agent something as consequential as real cloud infrastructure.
2. Biggest insight I got about myself this week
I learn better while doing a video guide that helps people, which surprisingly makes the learning and doing more interesting.
3. My biggest weakness or loop I noticed
The loop I kept catching myself in was trusting documentation over the actual state of the repo. This project's own CLAUDE.md includes a candid note that earlier commits referenced .claude/skills/, a GitHub Actions workflow, and a terraform/ directory, but those were later deleted from the working tree, meaning the "documented" pipeline was aspirational, not real. More than once I found myself reasoning about a file as if it existed because a description said it should, instead of running git status or listing the directory first. It's a small habit gap, but in DevOps, where "what's documented" and "what's actually deployed" can quietly diverge, it's exactly the kind of gap that causes real incidents.
4. One system I will implement this week
Before running any skill or command that touches infrastructure, like
/scaffold-terraformor/tf-plan, I will first rungit statusand check the relevant directory to confirm what actually exists on disk, rather than trustingCLAUDE.mdor a skill description alone. I'll do this at the start of every task, not just once per session, so I stop building on assumptions about files that were deleted, renamed, or never committed in the first place.
5. What I learned about Agentic AI and DevOps
Before this internship, "AI" meant a chat window that answered questions. This week reframed it as an operator with guardrails. An agentic AI can follow a structured workflow end-to-end, scaffold Terraform, run a plan, hand the output to a security-auditor or cost-optimizer subagent, and only then wait for a human to approve tf-apply, instead of producing a single disconnected answer.
What stood out most is that the safety doesn't come from the model being well-behaved; it comes from design. tf-plan physically cannot write files. Destructive commands are denied at the settings level, not just discouraged in a prompt. Hooks fire before and after every shell command to check and log what's happening, whether the model "intended" to be careful or not. Reusable skills cut the repetitive typing, which is nice, but the real lesson is that DevOps engineers now have to design two things at once: the automation, and the control layer that keeps it honest. Human review before apply isn't a leftover step from the pre-AI era. It's still the last line of defense.
6. My Week 2 highlight
Highlight of this week will be understanding and actually creating skills and sub-agents, using claude.md as a guide to make sure my agent has the correct context to work with.
I had a bit of an issue with Terraform, but this made me understand the flow better.
This is Week 2 of my reflections from the DevOps Micro Internship. If you're on a similar path, I'd love to hear what clicked for you this week too.
Top comments (0)