Observed arrival · 2026-11-12
Diffhold previews and gates AI-agent changes to Kubernetes
A pre-alpha control layer that previews Kubernetes changes from AI agents, applies policy, requests approval for risky actions, and grants a credential limited to the approved change.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Kubernetes operators managing AI-agent writes
- Worth noticing
- The demo replays a one-use grant: the same change passes once; altered scaling, deletion, and Secret reads are denied.
Field notes
The homepage says raw-shell calls that cannot be mapped to Kubernetes objects are denied. AgentPolicy rules combine verb, kind, namespace, and CEL conditions, while risky rules can require named approvers. The project reports about 11 ms p50 dry-run overhead in kind testing and says its end-to-end suite runs in CI on every push.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue