93% have had an AI infrastructure incident. A quarter would still ship HCL unread.

A third of 76 percent is roughly a quarter, so about one infrastructure team in four says it would put AI-generated HCL into production with nobody reading it at all ^[1]. That is the number the report does not print, and it sits in a population where the incident rate is close to universal ^[1] and the public cases include an AI tool deleting a database ^[16]. The incidents happened. The review habit did not move ^[2].

Review is the one layer in Spacelift's five-layer model that spends human attention ^[7], and attention is the input the same survey says has gone scarce: demand on infrastructure teams is up while review capacity has stayed flat, which the report links directly to reviewers skipping reviews ^[6]. A control that depends on a queue nobody can clear is not a control.

Sort the guardrails by whether they need a person present. Golden modules, private registries, policy as code and AI tool configuration all bind before a prompt is answered ^[8]. A single delivery path, approval gates, short-lived agent identities and destructive operations denied by default bind at execution ^[9], which matters because agentic tooling can already plan, edit and sometimes apply changes with limited human input ^[14]. The review layer is mixed: static analysis, secret scanning, policy enforcement and cost checks run themselves, while mandatory pull requests and CODEOWNERS approvals only work if someone reads the diff ^[10]. On the survey's own numbers, the machine-run half is the half that will still be operating on a Friday afternoon.

The two failure modes the report names are not review-shaped anyway. Slopsquatting begins with a plausible invented module or package name that an attacker has registered, and it installs on the next run ^[11]. A reviewer checking HCL for tags and topology has no way to tell an invented name from a real one; a private registry and a pinned version do. Prompt injection arrives through the module docs, READMEs, tickets and pages an agent reads, which the agent cannot separate from instructions, and OWASP ranks it the top risk for LLM applications ^[12]. How far it travels depends on whether the agent holds state files and credentials while also being able to call APIs ^[13]. Those are identity and permission settings, decided before the agent runs.

One caution on provenance: every figure here comes from a vendor's own survey, published on its blog next to the guardrail model it recommends ^[15]. The internal arithmetic is what makes it worth reading. Eighty-six percent of infrastructure leaders say they are confident they can govern AI; thirty percent have a written policy ^[4]. That is a fifty-six point gap ^[2], and confidence at that level on that base is the first claim to distrust.