Permissions and access
A connection’s effective access depends on the selected projects, granted scopes, expiry, revocation status and your current project permissions. Granting a scope does not grant access to a project you cannot use yourself.
Choose the narrowest useful access
| Scope | Allows |
|---|---|
platform:read | Discover context and inspect authorized projects, pools, applications and deployments |
deployments:write | Prepare and apply deployment plans, with current project write permission |
logs:read | Read bounded build and runtime log snapshots |
sources:upload | Prepare and inspect ZIP upload intents |
config:write | Required when updating an existing application’s configuration |
secrets:write | Required when supplying environment changes |
Select only the projects the workflow needs. Browser consent supports 1-, 7- or 30-day connection expiry. Review the actual options in the dashboard.
Read first, then request additional access
The initial OAuth flow requests platform:read. A tool that needs additional access returns an insufficient-scope challenge. A compatible client can request consent and retry; the server does not silently broaden access.
An agent can call get_context with requested_scopes to request the permissions needed for a workflow before preparing a plan or upload. This requests authorization; it does not bypass consent.
Environment values
Saved environment values are not revealed through the application inspection tools. An agent can supply values with the required scope, but readable plan summaries contain environment keys rather than the supplied values.
Avoid putting secrets in application names, repository URLs, build output or agent messages. Log redaction cannot identify every arbitrary secret.
Revoke or expire access
Manage connections in account settings → Agents. Revoking a grant blocks future access. Removing your project write permission also removes the connection’s ability to deploy to that project.
Revocation cannot undo a deployment already submitted to infrastructure. Inspect the application in the dashboard if a change needs follow-up.