Of infrastructure leaders surveyed, 86% say they’re confident in their AI governance. Only 30% have a formal policy. There’s a structural vulnerability gap, and it’s growing.
The finding that jumped out at me from Spacelift’s 2026 State of Infrastructure Automation research is a dangerous contradiction. When infrastructure leaders were asked whether they’re confident in their organization’s ability to govern AI, 86% said yes. When we asked whether they have a formal AI governance policy in place, only 30% do.
I’ve worked as an analyst (Gartner), a vendor (AppDynamics, Cisco, Kentik, Logz.io and Paessler), and now running product and design at Spacelift. Governance has always mattered, whether in observability, data infrastructure, or with IaC, so what surprised me about this data was that so few organizations had even put a policy document in place, the first step. That seems like table stakes before you start training your teams and using something that can impact your business. The confidence number on top of it (86%, when fewer than a third have documented anything) is more striking than either number alone. One explanation is that the survey takers are unaware of these policies, which is even more concerning.
Docs Are Insufficient
Most of the governance conversations I see focus on policy: do you have a written standard, an approved framework, a compliance checkpoint? That’s the foundational step with your legal and compliance teams, but not sufficient. The real challenge is more fundamental.
You are using something non-deterministic to do something deterministic: deploying and managing infrastructure. Those two things are in tension. The same prompt, run twice, can produce configurations that behave differently. Drift and hallucinations become a production risk when AI is generating Terraform or HCL at scale. The governance problem is whether your delivery system can catch and block it before it ships, and, hopefully, guide it towards the right deterministic outcome.
I see this play out when organizations build their own tooling and agents using models like Claude or Codex. When they use APIs without proper guardrails, agents will find a path, often circumventing the controls, even when controls are provided as instructions to the LLM. This results in a lot of verification and rewriting of code.
This is a signal that governance isn’t working. If policies are implemented at the pipeline level, verification can be far more automated and proactive at preventing issues, but you have to incorporate them into your pipelines.
With the velocity of code today, enforcement by document will not scale. Even if you explicitly instruct an AI to read a policy, it will fall out of context and be forgotten. Governance must be structural.
What Formal Governance Looks Like
What separates organizations with real governance from those that feel they have it is that governance in IaC is a property of the delivery system. It’s not a gate you bolt on afterward.
The order of operations matters:
Establish a single enforcement point. Every infrastructure change flows through one pipeline. VCS-backed, plan-before-apply, peer review, no execution from laptops to production. Most organizations discover at this stage that a significant portion of their changes are happening out of band.
Lock down identity and access. Replace static keys with short-lived credentials issued via OIDC, and scope roles to the least privilege needed per stack and environment. Keep proposal and approval in separate hands, with RBAC structured to mirror your org chart.
Embed policy as code, evaluated on every plan. This means automated guardrails governing what resources can exist, with approval thresholds scaled to blast radius and automatic flags on any change that touches IAM or could be destructive. (One practical note: run new policies in advisory mode first, then enforce. Going straight to hard blocks makes users create workarounds, and workarounds become shadow infrastructure.)
**Add a structural layer. **Include elements like drift detection, a private module registry with vetted and version-pinned modules, and immutable logging. Pinning modules is always a good idea to reduce the likelihood of supply chain attacks. You’ll know you’ve gotten it right when governance reduces friction. Self-service within guardrails beats ticket queues, and the audit trail is complete because the paved road actually gets used.
Instrument what AI is doing. Right now, 15% of organizations track the volume of AI-generated IaC moving through their pipelines. Only 20% track error rates of AI-generated changes. You can’t govern what you can’t see. We are seeing advances in observability for AI driven by OpenTelemetry, and vendors are providing this increasingly in pipeline tooling.
Success Looks Like Success. Until It Doesn’t.
Part of what makes this hard to catch at the executive level is that the early indicators look positive. Developer velocity is up. More pull requests are merging. In our research, 89% of organizations say AI has increased developer velocity, and 82% report that between 25% and 74% of their code is now AI-assisted.
The dysfunction occurs downstream: in the testing queue, in the security review backlog, in the compliance audit that flags a misconfiguration that somehow made it to production. Among the organizations in our research, 40% report security vulnerabilities appearing faster than before.
This finding is surprising, given how much automation is baked into modern pipelines. The velocity most teams achieve normally incorporates these guardrails. It’s worth investigating pipelines for similar gaps.
The organizations categorized as Pioneers in the research (those that built governance infrastructure before scaling AI adoption) have formal policies in place at a rate of 71%. Only 4% of organizations categorized as “Exposed” have formal policies in place. The difference in outcomes between the two ends of this spectrum is measurable: 17% of Pioneer organizations report no AI-related infrastructure incidents, whereas only 3% of Exposed organizations report none.
A Realistic Look at Agentic AI
The research shows 89% of organizations plan to adopt agentic AI for infrastructure, with a quarter planning to do so within six months. Based on what customers and the survey say, read those numbers with a pinch of salt. What organizations say they want and what they actually do are often quite different, particularly when the operational implications become concrete.
On the infrastructure side, organizations are not moving to fully agentic workflows at any meaningful scale right now. That’s appropriate. The governance challenges for AI-assisted development, where a human still reviews the output before it is applied, are already significant. When you remove that review step, governance has to be embedded in the workflow itself.
Agentic adoption will happen slowly, starting with low-risk actions, and move toward mainstream as engineering teams continue to push velocity upstream and platform teams have to respond. The 33% incident rate among early agentic adopters in our research is a data point worth watching. Best practice is to build the governance layer before expanding into agentic use, because retrofitting it after the first incident is understandably harder. It’s also more expensive, damages your company’s brand, and erodes the trust of teams.
What to Actually Do About It
CIOs and CTOs must take one concrete action based on this research: start with documentation, but don’t stop there. A written policy is the baseline, the underpinning for governance, but only if it gets built into the tools and technologies that actually enforce what the document says. Getting that connection right, with solutions that interface with modern AI tooling, is what separates governance on paper from governance in your pipeline.
A few questions worth putting to your infrastructure leadership directly:
Do we have a single enforcement point? Every infrastructure change should flow through a version-control pipeline. If significant changes happen out of band, that’s where the gaps are.What percentage of our infrastructure is codified? Pioneer organizations average 75%+ IaC coverage.Are we tracking AI-specific signals? That means error rates on AI-generated changes, the volume of AI-generated IaC moving through pipelines, and infrastructure drift attributable to AI output.Is governance embedded in the pipeline, or does it depend on humans reviewing fast enough? At the current AI velocity, manual review doesn’t scale.Are we planning to adopt agentic AI, and have we built the governance infrastructure first?
The challenge here is ultimately about people and process alongside technology. How do you keep the human in the loop while safely enabling velocity? That’s as much an organizational question as a technical one. And it’s harder than the tooling problem, which is saying something.
My experience as an analyst and as a product builder at multiple companies has proven to me, over and over, that governance is critical. But what’s changed in the last six or seven months is that AI has made the consequences of not having it immediate rather than eventual. The organizations pulling ahead aren’t the ones chasing AI adoption fastest. They’re the ones that built the platform capable of absorbing it safely.
The gap in our research is real, but it’s closable, and it closes in the pipeline rather than in a policy document.