Blog · 2026-10-19 · Gardience Engineering

Using AI to write Salt states and commands, safely

ChatGPT and Claude can write Salt states, and they can also invent modules and run the wrong thing on the wrong machines. The guardrails that make AI useful for fleet changes, and how to keep a self-hosted model in an air-gapped network.

Large language models are good at the parts of Salt people find tedious: remembering the right module, the argument names, the YAML shape of a state. Ask one for "a state that keeps nginx installed and running" and you will usually get something close. The risks are just as real:

• Invented functions. A module or argument that does not exist on your minions.
• The wrong target. A state meant for the web servers applied to '*'.
• Hidden commands. A "state" that quietly runs a shell command through cmd.run, onlyif, or a Jinja call.
• Nobody approved it. Copy, paste, run.

Those risks do not mean you should avoid AI. They mean it belongs behind the same guardrails as a person.

Guardrails that make AI safe for fleet changes#

1. The model proposes, a person runs. The assistant never has access to Salt. It returns a proposal; a person reads it and presses Run.
2. Proposals are checked like human input. Only functions your server actually allows, real targets, valid arguments; states parsed as plain YAML with no templates.
3. Show the dry run. States are applied in test mode first, so the person sees exactly what would change on each machine.
4. Same permissions, approvals, and windows. An AI-drafted change goes through the person's own permissions, two person approval if required, change windows, and locks.
5. Mark it in the audit log. Record that the change was drafted by the assistant, the request that produced it, and every machine's result.
6. Your model, your network. Let the customer choose the model, including a self-hosted one, and send it only what it needs: the request, page context, and names of groups and allowed commands, never secrets or audit data.

What this looks like in Gardience#

Gardience, a supported console on open-source Salt, has an assistant called Ask Gardience on every page:

• Type "install nginx on the web servers" or "keep example.txt in /opt/scripts with this text".
• It proposes the exact runbook, Salt command, or saved state, shows the target machines and a dry run, and waits.
• Nothing runs until a person presses Run, under their permissions, approvals, and change windows. Each request and each change it drafted is in the tamper-evident audit log.
• It works with Claude, OpenAI, Azure OpenAI, or a self-hosted model that speaks the same API, so air-gapped sites can use AI without data leaving the network. It is off until an admin turns it on.

For your own AI agents, Gardience also has an MCP server, so Claude, Cursor, or Copilot can read fleet status and request changes that wait for a person to approve, under keys limited to the groups you choose.

Questions#

Can ChatGPT write Salt states?#

Yes, often correctly, but it can invent modules or arguments. Always check proposals against the functions your minions actually have, and apply in test mode first.

Is it safe to let an AI agent change servers?#

Only if it cannot act alone: it should propose, and a person with the right permissions should approve and run, with every change recorded.

Can I use AI in an air-gapped network?#

Yes, with a self-hosted model on the same network. Gardience's assistant works with self-hosted models that speak the OpenAI-compatible API.