> I have the agent write a script that is aimed to be idempotent and then run the script.

You can take this one step further and have the agent write Terraform configs [1]. I did this (including having the agent import all the initial resources from the live device), works great and is generally more robust than a script.

[1] https://github.com/terraform-routeros/terraform-provider-rou...

I originally wrote specific terraform providers (even one for just configuring an Ubuntu machine), but over time I found that TF is a bit too heavyweight for my use-cases. The shell script works well because state divergence can be investigated by the LLM. The slowness of state refreshing etc. does make a TF apply painful. For me at least.