The console fix nobody wrote down
During an incident an engineer widened a security group by hand. The infrastructure code hasn't run in three weeks, so the next apply — for something unrelated — will either silently revert that fix or fail on unexpected state.
Nobody can say which of forty accounts still match their code. The repository describes a desired state and nothing continuously checks reality against it.
Boundaries, outermost first: Cloud accounts: Console changes (out of band; FAILED: unrecorded), Actual state Outside every boundary: Infra code (desired state), Alerting, an empty slot for the runs on a timer Connections: Infra code controls runs on a timer — desired (step 1) Actual state controls runs on a timer — observed (step 2) Console changes publishes to Actual state — drift enters here runs on a timer controls Alerting — differences (step 3)