Gate

llms.txtlists every page for an agent

Optional: hand this page to your coding agentThe steps work by hand too.

Follow https://intentius.io/choudoufu/gcp/gate/. Draft the project IAM bindings granting one principal this estate and show them to me.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.

Show the whole prompt

Follow https://intentius.io/choudoufu/gcp/gate/. Draft the project IAM bindings granting one principal this estate and show them to me.
Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.

AWS KubernetesGCPAzure

Each estate gets its own project. Its runner holds the project bindings:

gcloud services enable cloudasset.googleapis.com --project=PROJECT
gcloud projects add-iam-policy-binding PROJECT --member=PRINCIPAL --role=roles/cloudasset.viewer --condition=None
gcloud projects add-iam-policy-binding PROJECT --member=PRINCIPAL --role=ROLE --condition=None

ROLE is the GCP role for the resource types in the estate, such as roles/compute.networkAdmin. choudoufu reads Application Default Credentials, set with gcloud auth application-default login.

What that buys

Reads and writes are fenced per principal. Handing an estate over moves the bindings, and gcloud meets the same fence.

Guarding the marker

Keep folder and organization bindings to the admins who create projects (estate-grant.sh).

choudoufu