This article shows how to export Terraform plans to JSON and evaluate them with conftest policies written in Rego, enabling deterministic auto-apply of safe changes. It walks through examples for allowed actions, resource types, field diffs, blast radius limits, and environment gating to keep control while boosting velocity.

• Terraform plans can be exported to JSON (`terraform show -json`) and tested against Rego policies via conftest to auto-apply only compliant changes.
• AI review tools like Overmind are non-deterministic and fail audit requirements for human sign-off, whereas codified policy checks give repeatable, versioned decisions.
• Policies can be as granular as needed: restrict to no-op/create/read actions, gate specific resource types (RDS, IAM), limit changes to certain fields (tags), cap the number of modified resources, or vary rules by environment tag (staging vs. production).