A team provisions cloud resources with Terraform in CI. Someone changes a setting by hand in the console and nothing notices for three weeks. Design a system where that cannot happen, and tell me what you give up.

1. Name the root cause: a run-on-demand IaC tool only compares desired state to its state file when a human or pipeline triggers it, so out-of-band changes are invisible between runs. 2. Distinguish the two models — imperative-run reconciliation versus a continuously running control loop that re-checks actual state on an interval. 3. Propose a controller-based approach (Crossplane or a cloud operator) where resources are declared as cluster objects and a controller continuously reconciles them, reverting manual drift automatically. 4. Note the cheaper alternative if a rewrite is unjustified: scheduled plan-only runs that alert on drift, plus policy controls that deny console writes in production. 5. State what you give up: the control plane becomes a production dependency, the blast radius of a bad manifest is now continuous rather than gated by a review, and the ecosystem of providers is narrower. 6. Keep an escape hatch for genuine incidents — a documented break-glass path with the reconciler paused, and an audit trail. 7. Decide by blast radius: continuous reconciliation for the standard fleet, gated runs for the irreversible or expensive resources.