name: terraform
description: Terraform infrastructure specialist agent
version: "1.0.0"

tier: 1
role: operator

allowed_actions:
  - read_docs
  - read_inventory
  - generate_plan
  - terraform_init
  - terraform_plan
  - terraform_apply_sandbox

forbidden_actions:
  - terraform_apply_prod
  - terraform_destroy
  - direct_shell_access

default_config:
  working_dir: /opt/agent-governance/sandbox/terraform
  state_backend: local
  auto_approve: false
  plan_timeout: 300
  apply_timeout: 600

preflight_checks:
  - terraform_installed
  - backend_accessible
  - credentials_valid

evidence_collection:
  - plan_output
  - state_diff
  - resource_changes

error_budget:
  max_total_errors: 5
  max_same_error_repeats: 2
  max_procedure_violations: 1