Michael Forrester leads AI workforce transformation at Accenture LearnVantage and builds tools that constrain how agents act on infrastructure. His work spans technical education and agent governance: what people need to understand before delegating work to AI, and which operations software should permit even when a model agrees to perform them.
From infrastructure operations to technical education
Michael founded Majere Enterprises, an infrastructure and team-performance consultancy, and later led infrastructure and operations at WorthPoint, including a data-center-to-AWS migration. His career history includes engineering operations at Inform, technical operations at IgnitionOne, digital architecture at Honeywell, platform architecture at ThoughtWorks and certification architecture at AWS.
At KodeKloud, Michael became Principal Training Architect, overseeing curriculum strategy across AWS, cloud-native technologies and AI. His work included instructor-led, virtual and on-demand training. At Accenture LearnVantage, his focus extends to how organizations adapt jobs, skills and working practices to AI.
His critique of four-hour executive AI workshops explains a specific limit of tool training: generating a plausible engineering proposal does not give a leader the expertise to assess its dependencies, implementation cost or effects on other systems. Michael favors teaching executives to identify worthwhile problems, ask sharper questions and evaluate work within their own responsibilities. Engineers still need to determine whether a proposed change can work in the codebase. The distinction is between learning to produce an answer and acquiring the expertise to evaluate it.
Putting limits around agent actions
Michael’s projects turn that concern about delegation into concrete controls:
Deliberate friction for destructive operations. His Argo CD MCP server distinguishes inspecting a deployment from modifying or deleting it. It starts read-only, previews writes by default and requires additional confirmation parameters for destructive actions. His design account grounds those choices in an ordinary operational risk: a tired engineer may approve the wrong action while an agent helps with an outage. Secret masking limits disclosure, rate limits constrain how quickly the agent can act, and audit logs help operators reconstruct what happened.
Enforcement outside the model.Agentic Covenants separates instructions inside an agent, controls in its client and enforcement in external infrastructure. A prompt can request restraint; a scoped service account or admission policy can deny an operation. The framework applies these layers to identity, authorization, blast radius, approvals, supply chains and content integrity. Michael also identifies their limits: deterministic permissions cannot reliably recognize every malicious instruction or detect a harmful sequence made entirely of authorized actions. Those cases require complementary detection and content analysis.
Learning through controlled failure. With Whitney Lee, Michael develops Unleash an Agent, Watch It Burn, a hands-on workshop built around an agent with Kubernetes access. Participants attempt attacks, add controls and test again. In their joint demonstration, a burrito-ordering assistant deploys an external container image and exposes a secret recipe. The mundane interface makes excessive agency visible: a request about food can become an infrastructure operation when the assistant has the tools and permissions to carry it out.
The workshop also preserves the difference between an intended safeguard and a demonstrated result. Kyverno admission rules restrict image sources and deployment requirements, while intended runtime protections do not consistently prevent recipe access. Separate input and output filters demonstrate blocking a request before model processing and redacting sensitive content from a response. Changing model refusals between attempts reinforces the need for controls that do not depend on the model choosing to refuse.
A weather tool adds another failure mode: its description asks the agent to read internal configuration alongside a legitimate task. OpenTelemetry traces in Datadog expose the prompts, tool calls and results, allowing participants to inspect that behavior. Michael and Whitney’s exercise connects familiar platform protections with the additional risks introduced by agent instructions, tool descriptions and generated output; it does not present any one layer as sufficient.
Teaching the complete platform
Michael brings these concerns together in Agentic DevOps with Claude Code, published in September 2026. The book develops an internal developer platform with specifications, permissions, tests and approval gates around coding agents, then adds governed tools, model serving and observability. It gives readers a complete build through which to examine how those controls interact, carrying his work in infrastructure and technical education into the operation of agent-driven systems.
Michael Forrester and Whitney Lee turn a burrito assistant into a Kubernetes attack interface, then test where infrastructure policy, input and output filtering, and tool controls actually intervene.
A persuasive business story changed BurritoBot's willingness to deploy an image; Kubernetes admission policy supplied a separate decision about whether deployment was allowed.
Runtime detection followed by a response differs from preventing an operation. The workshop's intended filesystem block failed, even though the distinction remains useful.
Output filtering can redact an answer after generation; input filtering can reject a request before main-model processing. Their costs and protection points differ.
▶ Watch ↗