Action class: Deployment / infra change
How this side effect is governed
Default policy. Escalate for production; policy-allow for low-risk sandbox.
Required evidence. Change receipt, CI evidence, rollback path.
MINDBURN LABS
Inspect surfaceAI software
Production access for AI ops agents, with a boundary
Bound what AI ops copilots can change in production. Deploys, infra edits, and incident actions route through a fail-closed verdict with rollback and signed receipts.
The problem
The action is the risk, not the model.
An ops copilot that can deploy or restart production carries the same blast radius as a senior engineer. The question on every review is what it may do unattended, and what it leaves behind.
Granting this agent access means it can deploy services, change infrastructure, and remediate incidents. Each of those is a side effect someone has to answer for.
What HELM does
A verdict before the side effect runs.
HELM checks the proposed action against policy before any effect runs, then records a signed receipt. Here is one path for ai ops copilots and devops agents.
Agent proposes
Agent proposes a production deploy during an incident
HELM checks policy
Checks environment, change window, and rollback plan
Verdict
ESCALATE
Proof
Change receipt + approval + healthcheck receipt
Proof you can hand to a reviewer
Evidence that survives outside the dashboard.
Each governed action leaves a record your security reviewer can verify offline.
- Incident-action receipt
- Escalation queue entry
- Replay report
Questions
What reviewers ask first.
Can the agent act without approval?
Not for this action class. HELM checks the proposed action against policy before any side effect runs. For deployment / infra change the default is "Escalate for production; policy-allow for low-risk sandbox", so anything unknown or unapproved stops by default.
What evidence do I show a security reviewer?
Every decision records change receipt, ci evidence, rollback path. You hand the reviewer the signed receipt and EvidencePack, which they verify offline without access to your dashboard.
Does this slow the agent down?
The check sits in the action path, not the conversation. Low-risk actions that policy already permits proceed; only consequential side effects pause for a verdict or an approver.
Keep reading
Follow the proof path.
Hand your reviewer proof, not promises.
Bring one deployment / infra change action to the boundary and see the verdict and the receipt.