Bind review to the artifact that will execute
What This Concept Is
Review approval applies to a particular proposed change in a particular environment. Rebuilding a plan after review can change its actions even when the source commit is unchanged: state, variables, provider versions and external observations may differ. A review trail must identify the executable artifact, not merely a screenshot or a successful pipeline.
Why It Matters Here
The original safe-plan pipeline asks you to reject unwanted replacement, privilege expansion and cost growth. Those checks matter only if the applied artifact is the one checked. A checksum identifies bytes; it does not prove the reviewer was authorized or the artifact is safe. Preserve access controls and review identity separately.
Concrete Example
Runner A and runner B both plan against state serial 4. A's reviewed change is applied, producing a newer snapshot. B later acquires the lock. The lock prevents simultaneous mutation, but does not make B's older observations current. In the teaching model B's plan must be rejected, regenerated against the new serial and reviewed again. Changing only B's recorded serial to bypass the rejection defeats the check.
A second mistake is to review a saved plan and then run a fresh unbound apply. The new proposal can differ. Record the source revision, input source/version, tool/provider lock information, environment/backend identity, plan artifact digest, review and execution record. Protect the saved artifact: it can contain sensitive values even when terminal output hides them.
Common Confusion / Misconception
A valid state serial does not prove cloud resources have not changed outside Terraform. A saved plan is not a database transaction spanning all provider operations. It can still fail partially, and new constraints can make an old approval inappropriate. Define a review-expiry rule based on the change context, not a universal number of minutes.
How To Use It
In the original pipeline, separate plan generation from execution but bind them to the same protected artifact and target. If the artifact, target or material assumptions change, replan and review. Preserve a digest in public-safe evidence while keeping sensitive plan/state files out of the portfolio. Use synthetic values during training.
Check Yourself
What exactly did the reviewer approve? Does an unchanged commit imply an unchanged plan? What does the lock protect? Can a checksum alone establish authorization? What happens after a provider call partially succeeds?
Mini Drill or Application
Make two plans from the same model serial; apply one, then attempt the other under a new lock. Explain why the second fails even if both propose the same value. Add an artifact-substitution tabletop to the original plan review and identify which evidence detects it.
Read This Only If Stuck
Terraform plan describes saved plans and their sensitive contents. Read its exact options for your installed version.
Pro Git supports versioned change and review discipline; the linked HashiCorp documentation governs Terraform behavior.