Infrastructure with AI Agents
A few weeks ago, I wrote about managing infrastructure with AI. That work established central ownership for networking, monitoring, secrets, and recovery.
The last two weeks addressed a different question: What must infrastructure look like when AI agents become recurring operators rather than occasional coding assistants?
The agents worked across the Gateway, Server, Grafana, OpenClaw, VideoAnalysis, LAN-Control, and WTF repositories. They repaired production failures, refactored system components, improved network policy, extended monitoring, and strengthened guarded workflows.
The important result was not the volume of generated code. It was the conversion of recurring operational problems into explicit system boundaries.
1. The right language for each system layer
The largest technical change was a clearer separation between three layers: the application/management plane, the control plane, and the system/infrastructure plane.
TypeScript sits in the application/management plane. It defines typed tools, APIs, and operator interfaces that let agents and people request work without hiding the target, scope, or authority of an operation.
Python owns the control plane. It applies automation policy and coordinates analysis, media processing, image screening, documentation generation, and other data-heavy workflows.
Rust owns the system/infrastructure plane, where a stalled process, malformed input, or uncontrolled resource can affect the complete environment. This includes network control, metrics, traffic records, recovery checks, runtime supervision, and other privileged or persistent operations.
The purpose was not to rewrite everything in a fashionable language. The purpose was to place each responsibility at the boundary it fits while preserving existing commands, schemas, deployment paths, and rollback behavior.
2. Typed management for agent operations
Cross-platform administration had become a repeated source of errors. One command could pass through PowerShell, SSH, and a different remote shell before it reached the target system.
A custom LAN-Control MCP replaced that path with a workstation-local, typed management interface for attended operations. It validates the host, path, service, and requested action before it stages one native script on the target. Output, execution time, file access, and concurrency stay bounded.
TypeScript is a natural fit for this application/management plane. It provides explicit tool schemas and structured results for Codex and VS Code without placing another agent or scheduler on the managed hosts.
Scheduled maintenance remains separate. Server-owned Ansible performs unattended backup and update work. LAN-Control remains the operator path for authorized investigations and changes.
3. Six focused Grafana views
Observability became the shared interface between the infrastructure, the agents, and me.
The Grafana environment now operates as six focused views: Default, Work, Weather, Gateway, Network, and Twitch. Each dashboard has a clear purpose and its own browser and iOS identity.
The Network dashboard provides the clearest infrastructure overview. It places Server and Gateway service health side by side and keeps current WAN traffic visible below them. The broader stack also gained stricter version pinning, bounded retention, stronger service catalogs, and focused backbone alerts.
This is more useful than a large collection of decorative green panels. The dashboards show the same service ownership, health, metrics, and traffic state that an agent uses during an investigation.
4. Network intent became policy
The network work provides a concrete example of the operating model.
A large transfer could previously consume most of the available uplink even though CAKE already provided congestion control. The problem was not a broken queue. The policy did not distinguish ordinary sustained transfers from latency-sensitive traffic.
The Gateway now identifies sustained bulk transfers and makes them yield during congestion. Twitch traffic from the streaming workstation receives a higher service class, while essential control traffic remains protected.
The lasting result is not one repaired incident. It is a network rule that expresses the intended outcome and survives a reboot or configuration reload.
From assistance to operations
Running infrastructure with AI agents requires more than broad shell access. It requires typed interfaces, observable state, bounded execution, clear ownership, and reliable rollback.
The agents became more capable during these two weeks. More importantly, the infrastructure became harder for them—or me—to operate incorrectly.