DevOps Engineer agent

The DevOps Engineer agent handles changes to infrastructure and delivery pipelines. It plans the steps, the rollout and the rollback, how to validate the change, and the operational risks.

Where it runs

DevOps Change runs four steps in order: the DevOps Engineer plans, the Security Auditor reviews the risk, the DevOps Engineer runs again to apply the plan with that review in hand, and the Tester plans the validation.

Inputs

• The session task, for example "move the staging deploy to a manual approval step".
• A read-only snapshot of relevant files from the project's repository: pipeline definitions, Dockerfiles, Helm charts, Terraform and similar.
• In the Apply step, its own plan and the security review.
• Tools from connected MCP servers, if your workspace policy allows them.

Outputs

• DevOps plan: the steps, the rollout order, how to roll back, how to check the change worked, and what could go wrong. The plan is synced to the workspace plan board.
• Apply: the concrete file changes that carry out the plan, described per file.

The session's code pass then writes those changes into a throwaway copy of the repository and produces a diff. That diff goes through the release gate and approval like any other change.

Example run

Illustrative example, not a recorded session. Matt asks for container image scanning in CI. The DevOps Engineer reads the existing workflow file and plans a scan job after the image build that fails on critical vulnerabilities, with a rollback of simply reverting the workflow change. The Security Auditor notes that the scanner's own image should be pinned by digest. In Apply, the DevOps Engineer adds the pinned digest to its file changes. The Tester lists how to check the job: a known-vulnerable test image should fail it, a clean one should pass.

Limits

• "Apply" means writing the change, not running it. The agent has no access to your clusters, clouds or CI runners.
• It cannot see live state. Drift between your files and what is actually deployed is invisible to it.
• Rollback steps in its plan are advice. For tracked deployments and rollback in the console, see deploy and rollback.