Building a Terraform policy validator is exactly the kind of structured coding task AI handles well.

The task is structurally identical every run: parse a tfplan JSON, evaluate against fixed rules, format output, call the GitHub API. There is no unique judgment required per execution once the policy is written.

The high-risk categories are named (SG rules, IAM additions, RDS deletion), but edge cases within each category — e.g., which IAM actions count as 'additions', or what SG rule changes are acceptable — require upfront policy decisions that the task description leaves open.

Terraform plan output is a well-documented JSON format, OPA and Sentinel have rich documentation and examples, and GitHub's PR comment API is straightforward. An agent can access all necessary inputs and outputs programmatically.

A false negative (missing a real high-risk change) could allow a dangerous Terraform apply to proceed unreviewed, which is a real security risk. However, the validator itself doesn't apply changes — it only comments — so the blast radius is limited to missed warnings rather than direct infrastructure damage.

Writing the OPA/Sentinel rules and the PR comment formatter is mechanical coding. However, calibrating what constitutes 'high risk' in the specific org's security posture — and validating that the policy doesn't produce excessive false positives — genuinely benefits from a security engineer's review before deployment.