terraform plan answers one question: does this configuration match what Terraform already manages? It does not answer the one that breaks the deploy: does the network this cluster needs exist yet, with a way out to the Internet, in the tenancy this credential can reach?
Control Cloud runs that second question before the first one, against the live inventory of the account, and shows the answer as a list you can act on.
Read from the account, not from the plan
The pre-flight walks the template's dependencies and looks each one up in the provider: the network, the subnets, the firewall rules, the egress path. A subnet that is not there is red with the reason written next to it ("does not exist yet and is needed before deploying") and a button that opens the canvas where you create it. A private subnet with no NAT is a warning, because the deploy would succeed and the nodes would never pull an image.
What a green plan hides
A plan references the subnet by ID and trusts it. The failure shows up minutes into the apply, half the resources created, the other half waiting on something that was never going to appear. Catching it before any Terraform runs costs one read of the API with the read-only credential you already connected.
Where it runs
From the app: the canvas and the Pre-Deploy page, on the template you are about to deploy. It does not replace plan; it looks at what lives outside the state. Quotas are not checked yet; that one is on the roadmap and we say so.
Watch the 25-second clip · Full 60-second demo
Request access
Solo plan is free: 1 operator, 1 provider, no card. Team comes with a 7-day trial. Read-only access to map and check; write access only where you grant it.
What was the last thing a green plan did not tell you? I read every comment.
