Nobody applies from a laptop

What CI applies were missing

Moving applies from laptops to CI removes credentials from laptops. It does not guarantee that what a reviewer approved is what runs, and security rules still live only in reviewers' heads.

The platform's infrastructure is ordinary Go code on Pulumi, so every building block is unit-tested like application code before anything reaches an account.

What the platform guarantees

• Every change shows a read-only preview on the pull request.
• Every preview and every update is checked against security policy: opening access to the world, wildcard permissions, unencrypted storage and deleting protected resources fail.
• Only reviewed, merged code is applied, by the deployment service and never from a laptop. Production waits for a person.
• The applying system has its own identity and no long-lived keys.
• Drift is found on a schedule, not during the next incident.

A policy a pull request cannot weaken

If the policies lived next to the code they check, a pull request could change the rules that judge it. They do not: they are enforced by your organization, for every stack. Changing a policy is its own reviewed release, and overriding one is a recorded decision by its owners.

What it changes

Only the code a reviewer approved reaches an account, and security rules are enforced on every change rather than remembered by reviewers.