A team starts merging Terraform code generated by an AI agent connected to the Terraform MCP server. A reviewer asks whether the usual pipeline gates still need to apply to that code. What is the correct policy?
Select an answer to reveal the explanation.
Short Explanation
An AI agent is a fast junior engineer, not a certified inspector. You put its code through the same gates as everyone else's: formatting, validation, plan review and policy. The trap is assuming that good documentation lookups mean the change itself has been checked.
Full Explanation
Generated code is still code, and its risks, wrong arguments, unsafe settings, unintended destroys, are the same as or greater than those of human-written changes. The Terraform MCP server improves the agent's inputs by providing current documentation, but it does not test the result. The established gates each catch a different class of problem: terraform fmt -check enforces style, terraform validate catches syntax and type errors without contacting providers, a reviewed plan shows exactly what will change, and policy as code enforces organizational rules on that plan. Registry documentation lookups do not evaluate the change against real state or reveal destructive actions, so they cannot replace plan review. terraform validate checks configuration correctness only; policy sets are evaluated by HCP Terraform or Terraform Enterprise during a run, after the plan, and validate knows nothing about them. Policy sets attach to workspaces and evaluate every run in scope; they have no notion of who authored the commit, so there is no human-only exemption. Exam caveat: HashiCorp's MCP guidance warns about hallucinations and prompt injection, which is why review of write operations remains mandatory. Operational check: confirm the branch protection rules require the same status checks for all pull requests regardless of author.