skills.rest
Cloud-Byte-Consulting
Cloud-Byte-ConsultingOFFICIAL
Explore all skills by this author →
GitHub

iac-guardrail-verifier

Reviews Azure Bicep and Radius IaC against a four-layer policy enforcement model.

Updated Jul 16, 2026
Search Tags:#code review#azure#compliance#iac#policy enforcement#avm#bicep
One-click install
npx skills add https://github.com/Cloud-Byte-Consulting/plugins --skill iac-guardrail-verifier-cloud-byte-consulting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iac-guardrail-verifier
Source: https://github.com/Cloud-Byte-Consulting/plugins/tree/main/azure-platform-engineering/skills/iac-guardrail-verifier
Command: npx skills add https://github.com/Cloud-Byte-Consulting/plugins --skill iac-guardrail-verifier-cloud-byte-consulting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Agent- and human-generated infrastructure code can look plausible while violating platform rules, and this Skill provides an adversarial review layer that catches non-compliant Azure IaC before it merges. ## Core Features & Use Cases - Four-layer verification: Checks generation-time constitution rules (AVM-first, naming, tagging, private endpoints), plan-time static analysis (bicep build/lint, Checkov/OPA), deploy-time Azure Policy alignment, and runtime policy backstop coverage. - AVM module validation: Verifies module status from the machine-readable index, confirms registry-resolvable version pins, and flags Orphaned or Deprecated modules. - Demo-shortcut audit: Blocks production-targeted PRs still carrying marked demo shortcuts such as key-based Cosmos auth or public endpoints. - Use Case: A platform engineer receives an agent-generated Bicep PR for a new golden path; the verifier produces a per-layer findings report with pass/warn/block verdicts, constitution rule IDs, and concrete fixes. ## Quick Start Review this Bicep pull request against the four-layer guardrail model and report any blocking violations with their constitution rule IDs.

Frequently Asked Questions about iac-guardrail-verifier

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Azure Bicep code for policy compliance before merging?▼

Run the four-layer verification: check constitution rules at generation time, run bicep build/lint and Checkov/OPA at plan time, validate against Azure Policy at deploy time, and confirm runtime policy backstop coverage. Each layer produces findings with verdicts and rule IDs.

How to validate AVM module versions in Bicep templates?▼

Check each module's status in the machine-readable AVM index, requiring Available status and flagging Orphaned or Deprecated modules. Pins must resolve against the public registry, and unresolved pins fail the gate.

Can this verifier review Radius Recipes as well as Bicep?▼

Yes, it validates Radius Recipes including recipe contract checks on result.values shapes, which are treated as part of the golden-path API. Breaking those shapes is treated as a breaking change.

What happens when a PR still contains demo shortcuts?▼

Any production-targeted PR carrying a marked demo shortcut, such as key-based Cosmos auth, public Postgres firewall rules, or an empty OIDC issuer, fails verification. Each shortcut must be flipped to workload identity, private endpoints, or Entra auth before promotion.

Does the verifier fix the violations it finds?▼

No, it only reviews and never edits code. It emits a per-layer findings report with a verdict, the constitution rule ID or source, and the concrete fix, leaving implementation to the PR author.

Related Skills

Explore More Software Engineering Skills→
sohamdasohamda

azure-defaults

Applies Azure infrastructure defaults for regions, CAF naming, tags, AVM modules, and security baselines.

Community
Advanced
BagelHoleBagelHole
46

agent-evals

Build automated evaluation suites for AI agents with golden datasets and regression gates.

Community
Advanced
aviskaaraviskaar
6

ciso

Orchestrate enterprise security strategy, risk governance, and multi-domain program delivery.

Official
Advanced
RHEcosystemAppEngRHEcosystemAppEng
48

model-monitor

Monitor deployed InferenceServices for bias and data drift using SPD, DIR, and statistical metrics.

Official
Intermediate