You describe what you need in plain language - "give me a production VPC with NAT and private subnets on AWS" - and the agent maps that request to the right cloud and service, generates production-ready Terraform, validates it against policy and best practices, then deploys and verifies every resource is live and correctly wired. No provisioning catalog, no ticket, no clicking through the console.

It's checked against policy and best-practice configuration before anything gets applied — validation happens before deployment, not as a fix-it-later step. For example, a single VPC prompt configures the full networking stack — public, private, and intra subnets, route tables, NAT gateway, DNS settings — the way a properly architected environment would be built manually, just without doing it component by component in the console.

State is backed by S3, with your target region configured, and deployment runs directly from the portal — so state management isn't something you're separately wiring up or tracking outside the agent's flow.

No — that's the point of the plain-language prompt step. You describe the infrastructure outcome you want, and the agent handles mapping that to the right service, generating the Terraform, and validating it. You don't need to know the underlying HCL syntax or provider-specific configuration to get a correct result.

Networking is just the deep-dive example on this page — the agent covers 30+ services across each cloud, including compute (EC2, GCE, Azure VMs), managed Kubernetes, managed databases, serverless functions, and IAM. The VPC walkthrough shows the level of detail per service; the same approach applies across the rest of the supported service list.