A deploy-time gate that grades a whole Terraform change against one policy (OPA plus a language model) and blocks the apply unless every unit passes, using a throwaway workspace so a brand-new stack is still fully plannable.

Running a Jenkins build agent in Azure that reaches a private on-LAN controller through an Azure Relay hybrid connection – no public Jenkins, no inbound firewall change, no VPN.

A keyless, no-public-inbound Azure Function that watches a whole subscription for suspicious control-plane changes and freezes the affected resource group within seconds.