One architectural decision changed everything. "We don't deploy into our own cloud." Customers design their backend visually. Our platform generates the Terraform. It deploys straight into their cloud account — not ours. That sentence sounds simple. In practice it forced us to rethink five things: • Terraform state architecture — one isolated state per service, not one shared state per customer • Identity separation — every tenant runs on its own scoped credentials, sealed off from the rest • Existing-resource adoption — customers already have infrastructure, so we import it instead of fighting it • Parallel deployments — many resources at once, without stepping on each other • Runtime vs infrastructure health — "did it deploy" and "is it healthy" are different questions The hard part was never generating Terraform. It was making a system safe enough that someone would point it at their production account. I designed and built this end to end — the architecture, the Terraform generation, the deploy pipeline. If your team is heading somewhere similar, or you're about to point automation at a customer's production account for the first time, happy to compare notes. 👋