Agents do the work, your team steers
One policy.
Agents do the rest.
Write your rules once, and Cloudgeni agents run predefined workflows for compliance, drift, cost and reviews around the clock. Routine fixes ship on their own within the policy, and your team steers when it wants to.
- OCI
- Kubernetes
- On-prem
Prowler finding · CIS AWS 2.1.5
Block public access on prod-exports
- Read the finding and the bucket policy
- No public reads in 30 days of access logs
- Prepared the Terraform change
- Plan validated, policy checks passed
- Done:Compliance agentMerged #482 within policy: public access blocked on exports
- Done:Drift agentReconciled 3 drifted resources into Terraform
- Working:SRE agentTracing 502s on checkout to an expiring certificate
- Done:Cost agentRightsized 4 idle VMs, saving $1,240 a month
- MajaSet the network workspace to Governed
- Done:PR reviewerCaught an open security group in PR #490
- Done:IaC pipelinePlan validated: 1 to change, 0 to destroy
- Needs review:Compliance agentEscalated an IAM change the policy cannot verify
Trusted by infrastructure teams at
- Cloud resources governed
- 16,603
- Cloud resources governed
- at Hydro
- Saved
- $200K
- Saved
- at Hydro
- ISO 27001 compliance
- 96%
- ISO 27001 compliance
- in a customer project at Kodemaker
- Agent pull requests merged
- 79%
- Agent pull requests merged
- by customer teams
Product walkthrough
See it in action
The loop
Agents run the whole loop
From the first signal to a verified fix, the agent does every step. Your policy decides what ships on its own, so routine work never waits for a meeting.
01
Detect
Finds what needs attention in your scans, findings and signals.
02
Investigate
Reasons across cloud state, IaC and operational signals.
03
Fix
Writes the change in your IaC and opens a pull request.
04
Check
Validates the plan against every rule in your policy.
05
Ship and verify
Merges within policy and confirms the issue is gone.
Your team’s part
Set the policy once
Pick how far agents may go and write your rules in plain English.
Steer when you want to
Redirect any agent from a shared chat or an @cloudgeni-ai comment.
Hear only about exceptions
What the policy cannot verify reaches the right person, with evidence.
One policy
Set the rules once, agents follow them everywhere
One policy per workspace decides how far agents may go, and your plain-English rules apply to every change they make. Routine work ships on its own, and only what the policy cannot verify is escalated to a person.
Authority level
Agents
- Merge and apply routine changes that pass every gate
- Keep a signed record of each decision
Escalated to your team
- Only changes to identity, secrets, state or CI, and anything your rules cannot verify
Your rules, in plain EnglishExamples
- Deploy only to EU regions
- Every resource has an owner tag
- Workspace spend stays under $5,000 a month
Emergency stop
Pauses all autonomous work in the workspace at once.
Production autonomy
Stays off unless an admin allows it, in Governed only.
- Sandboxed execution
- Read-only by default
- Pre-PR validation
- RBAC and SSO/SAML
- Full audit trail
- SaaS or self-hosted (Helm)
Predefined workflows
Switch on a workflow, the agents take it from there
Each workflow knows what starts it and what done looks like, so nobody has to write a prompt or babysit a run. Turn on the ones you need and add your own on a schedule.
- Starts on:New finding
Compliance remediation
Writes the IaC fix for a security or compliance finding, validates it and ships it within your policy.
- Prowler
- Security Hub
- Defender
- Vanta
- CIS
- ISO 27001
- NIS2
- Starts on:Drift detected
Drift reconciliation
Traces changes made outside your code and writes them back into IaC, or reverts them.
- Continuous detection
- Reverse patching
- Resource discovery
- Starts on:Pull request opened
Pull request review
Reviews every infrastructure PR for correctness, security and policy, and blocks what breaks the rules.
- GitHub
- GitLab
- Azure DevOps
- Policy gates
- Starts on:Every push
IaC pipeline
Runs plan, what-if and policy checks for your infrastructure code, wired into your Git provider.
- Terraform plan
- Bicep what-if
- GitHub Actions
- Azure Pipelines
- Starts on:Cost recommendation
Cost optimization
Turns waste into rightsizing and cleanup changes, with the saving estimated before anything ships.
- Rightsizing
- Idle cleanup
- Cost estimation
- Starts on:Incident
Incident investigation
Correlates logs and metrics to a likely root cause and prepares the reliability fix.
- Root-cause analysis
- Azure Monitor
- Datadog
- Grafana
- Starts on:On request
Resource import
Brings resources built in the console into IaC, using your existing modules where they fit.
- ClickOps elimination
- Module reuse
- Starts on:Label on a work item
Work items to pull requests
Picks up a labelled ticket and implements it as a pull request.
- Work item labels
- Pull requests
- Starts on:Hourly, daily or cron
Your own scheduled workflow
Runs any prompt on a schedule, from version checks to security reviews, and reports by Slack or email.
- Custom prompts
- Schedules
See the agents work on your own environment.
Integrations
Works with your existing stack
Connect everything your infrastructure touches. Each source makes every agent smarter.
- AWS
- Azure
- Google Cloud
- Oracle Cloud
- Kubernetes
- OpenShift
- Terraform
- OpenTofu
- Pulumi
- Bicep
- Helm
- GitHub
- GitLab
- Azure DevOps
- Bitbucket
- Datadog
- Grafana
- New Relic
- Confluence
- Slack
- Microsoft Teams
Also
Prowler, Security Hub, Defender, Checkov, Vanta, Azure OpenAI, AI Foundry, Bedrock, Vertex AI, GPU node pools, Terragrunt, CDK, CloudFormation, on-prem and private cloud, cloud billing, Azure DevOps Wiki and more.
Frameworks
- CIS
- ISO 27001
- SOC 2
- NIS2
- DORA
- HIPAA
- PCI-DSS
- EU AI Act
- ISO 42001
Ready when you are
Set the rules once.
Let agents run it.
Start in Observe, raise the level as the results earn your trust, and let the policy decide what ships on its own.