Layered Provisioning: Foundation vs. Per-Resource
Per-resource stacks reference the foundation layer but cannot create or destroy it. A failed per-resource provision rolls back via compensation, never touching the layer below.
PER-RESOURCE LAYER — frequently created / destroyed
Model deploy A
step 1 → step 2
Agent runtime B
step 1 → step 2
Pipeline run C
step 2 FAILS
→ compensate step 1
Resource D
step 1 → step 2
compensation rolls back,
stays within this resource
reads / references only — never creates or deletes
FOUNDATION LAYER — provisioned once, long-lived
Shared networking
provisioned per account/region
Base IAM & federation trust
reviewed, changed rarely
Account-level scaffolding
exists before demand does
Deleting a per-resource stack must never reach this layer.