An AI agent connected through the Terraform MCP server can create, update and delete HCP Terraform workspaces and their variables. Security asks for safeguards before the agent is used against the production organization. Which safeguards fit HashiCorp's guidance?
Select an answer to reveal the explanation.
Short Explanation
Treat the agent like a new contractor you just hired: give them a key to the rooms they need, not the master key, and check their work before it ships. That's least privilege plus human review. The trap is the owner token, which turns a helpful assistant into someone who can change everything.
Full Explanation
The MCP server acts with whatever permissions its HCP Terraform or Terraform Enterprise token carries, so the token defines the blast radius of any mistake, hallucination or prompt-injection attack. HashiCorp recommends limiting the token's permissions, for example a team token whose team has access only to the specific project or workspaces involved, and its security guidance tells users to always validate before making write changes. Requiring a human to review the plan of any agent-initiated change before it is applied keeps the final decision with an accountable person. An organization owner token grants unrestricted control of the organization, maximizing the damage an unreviewed or manipulated action can cause. TFE_SKIP_TLS_VERIFY defaults to false precisely so the server verifies the platform's certificate; enabling it exposes traffic to interception and is not a safeguard. The MCP server passes requests to the platform API; it does not validate whether a change is correct or safe, so auto-applying agent runs removes the only meaningful review. Exam caveat: policy sets and run tasks still evaluate agent-triggered runs, so governance applies regardless of who started the run. Operational check: audit the token's team access in the organization settings and confirm agent workspaces require manual apply.