Rule 1 of 8 · Chapter I — Portal Discipline
The portal is for reading; changes go through code.
Why this rule exists
A portal change exists only in the doer's memory. Template/CLI changes exist in git, in review, and in the next environment. Estates managed by clicking diverge from their own documentation within a month.
In practice
Investigate in the portal freely. When the fix is known, express it as Bicep/Terraform or a reviewed CLI script — then run that.
When it doesn't apply
True break-glass moments: fix it live, then backfill the code the same day.