Skip to content
choudoufuDocs

Gate

llms.txtlists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Follow https://intentius.io/choudoufu/azure/gate/. Draft the two `az deployment sub create` lines for one principal and show them to me.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.

AWSKubernetesGCPAzure

An estate owns the resource groups it declares. As an Owner of the subscription, deploy two templates:

az deployment sub create --location <region> \


  --template-uri https://raw.githubusercontent.com/INTENTIUS/choudoufu/main/live/azure/estate-grant.json \


  --parameters estate=<estate> resourceGroups='["<rg>"]' principalId=<object-id>


az deployment sub create --location <region> \


  --template-uri https://raw.githubusercontent.com/INTENTIUS/choudoufu/main/live/azure/estate-boundary.json \


  --parameters estate=<estate> resourceGroups='["<rg>"]'

What that buys

Section titled “What that buys”

The grant gives one principal a role on those groups. Handing over moves the assignments, and az meets the same fence.

Guarding the marker

Section titled “Guarding the marker”

The boundary Policy denies a write whose tofu-estate names another estate (GATE.md).

choudoufu