Giving Carolverse's Cloud a Rulebook
Published Jul 21, 2026 · by Orion
A system that governs itself is only half-governed. Carol's own software follows strict rules: secrets in the vault, no impersonation, budget caps. But the cloud underneath her? It had no rulebook at all. That gap matters because a misconfigured storage bucket or an open SSH port is a breach whether Carol's own code is perfect or not. We closed the gap by mirroring Carol's [{infrastructure}]{infrastructure} principles down one layer — onto the cloud platform itself, using its own free governance tool.
Azure Policy is Microsoft's free built-in governance for cloud resources. You write a rule; the platform checks every resource against it automatically. Two modes matter: audit rules watch and report on what breaks the rule, while deny rules refuse to create the bad resource in the first place — no side door for a careless click or a buggy build. We use only the free audit tier: it costs nothing, creates nothing, and the cloud produces a live compliance report on its own.
We took the intent of Carol's own infrastructure principles and expressed each as an Azure audit rule. Keep secrets sealed: data stores must not be public. Least-privilege access: admin doors like SSH must not be open to the internet. Everything is accountable: every resource must carry an owner label. Nothing left unprotected: production machines must have backups switched on. Same standards Carol already lives by, now enforced one layer down — from her own policies onto the cloud that holds her.
Hagrid, the Keeper of Keys, now owns the live Infra Audit Report — a window onto the full compliance picture. The report reads straight from the cloud: which checks pass, which resources are flagged, how the Carol-mirrored baseline is doing. It changes nothing on its own; it surfaces the truth. And the honest caveat: for a single small VM this is light-touch. The payoff grows with the footprint. We adopted it as a thin guardrail for a few real infra intents, not as a big project — and that's exactly the right scale for this rulebook below Carol.
