And I feel that at certain scales one should tell hosts what to do, not rely on some auto discovery Process - especially if that process is not out and out clon

And I feel that at certain scales one should tell hosts what to do, not rely on some auto discovery Process - especially if that process is not out and out cloning. That's one thing, in Chef, that scares me. Access control on node attributes is inexistent. Even in private/hosted chef. So that a node can modify its own run_list, its own tags, etc... A frontend node that gets rooted can suddenly become a backend database. If the environment is configured to allow for automated configuration of everything, this can get ugly very quickly. Even with Chef, human approval of new nodes and roles is still mandatory.