What can plan mode change?
Nothing on disk. Plan mode reads and researches until you approve the plan.
Learn
How Engineering Changes Get Approved
Topsoil is a private AI platform for engineering. This page is the part a reviewer asks about first: what has to happen before a change can land.
One Change, From Plan to Review
You hand Topsoil a task. It reads the repository and writes a plan. Plan mode stays read-only until you approve that plan, which is the pause you want before IAM, a network definition or a pipeline file. After approval, every edit arrives as a diff. In the default mode Topsoil asks before each file change, each command and each use of the network.
Commands run only when they start with an allow-listed prefix, and they run without a shell. Teams often allowlist project checks such as terraform plan or cfn-lint. Handed-over work lands on its own branch, in its own git worktree, and comes back as a pull request or a merge request. A person reviews it. On GitHub and self-managed GitLab, an unattended run opens that change as a draft.
Which files that loop is aimed at is a different guide: software, infrastructure and pipeline work on Amazon Bedrock. Government and defense teams comparing a vendor-hosted assistant should start with a Copilot alternative for government and defense engineering.
What Each Gate Does
| Gate | What it holds |
|---|---|
| Plan mode | Reads and researches only, until a person approves the plan. |
| Diffs and permission prompts | Every edit arrives as a diff. The default mode asks before each file change, command or network use. |
| Command allowlist | A command runs only when it starts with an allow-listed prefix, and it runs without a shell. |
| Isolated git worktree | Handed-over work is done on its own branch and comes back for review. Topsoil does not approve or merge. |
| Budgets | Checked before every model call. An AWS budget action your admin deploys is the backstop. |
Outbound network access for a command stays off until the tool asks and you approve it, and file paths are checked before a tool touches them. The full table is on the security page. Why those gates sit in the client, where the action happens, is the prompt-injection checklist.
Your Account Still Owns Identity and Spend
The gates above run in the Topsoil client, on the machine where the action happens. IAM in your AWS account still decides who can call a model and who can read which files. Monthly user and account budgets are checked before every model call, so a request over the limit is not sent. A limit inside Topsoil applies to Topsoil’s own calls, which is why the AWS budget action exists. Budgeting on Amazon Bedrock walks through each layer.
Nothing is sent back to Topsoil: no analytics, crash reporter, or font or CDN fetch. The network path and AWS GovCloud (US) setup are on deployment and GovCloud.
Your Existing Tools Keep Their Jobs
Topsoil edits repository files and runs allow-listed project commands. SAST, SCA, SIEM and the CI system you already run stay in place. Applying a cloud change stays on the review and deploy path you already use.
Questions
Frequently asked questions
Who merges a change Topsoil opens?
A person. The work comes back as a pull request on GitHub or Bitbucket Data Center, or a merge request on self-managed GitLab. Topsoil does not approve or merge it. Bitbucket Cloud is not supported.
Which commands can run?
Only commands that start with a prefix on your allowlist. They run without a shell. Network access for a command waits for a separate approval.
Is Topsoil a cybersecurity product?
No. Topsoil is a private AI platform for engineering. It can edit infrastructure and pipeline files in your repository and run allow-listed project commands. SAST, SCA, SIEM and the other security tools you already run keep doing that work.
Try it on your own codebase
A pilot runs in your own AWS account, with your models and your material, and ends with findings you can act on.