Editing Spacelift (section)

== Why Spacelift specifically ==

* Plan and apply are structurally separate, with a mandatory human confirm gate before anything touches AWS.
* Stack dependencies are a first-class, enforced object — not a README instruction to run things in order.
* Full run history via <code>spacectl stack run list</code> — every change, when, and why, queryable later.
* The automation API key is scoped read-only by design; it hard-fails on anything that tries to trigger a deploy. Read access for tooling and write access for a human are two separate credentials.

That last point is the one that actually matters most: it's the reason handing real, live infrastructure work to [[MAC]] was something to trust rather than something to worry about.

[[Category:Infrastructure as Code]]
[[Category:AWS]]
[[Category:AI Agents]]