fast-provisioning-guardrail

This skill should be used whenever a task involves creating, changing, or granting access to any GCP resource — creating a project, adding or modifying an IAM binding or role grant, provisioning a secret, KMS key, or CMEK, enabling an API, changing an org policy, or touching networking, folders, or service accounts. It enforces that every such write happens through FAST (Fabric Automation and Scalability Toolkit / Cloud Foundation Fabric) YAML plus Terraform plus a reviewed PR against the foundations repo, never via ad-hoc `gcloud` commands or GCP Console clicks — including when the request is phrased as "quickly," "just for now," "as a one-off," or "to unblock." Also use this skill when asked to bring an already-existing (brownfield) GCP resource under Terraform management, or when reviewing whether a proposed GCP change is safe to apply directly. Read-only/diagnostic GCP requests (describing a project, listing IAM bindings, checking quota, viewing Console screens) do not need this skill.