Let an AI agent deploy with limited permissions
Let an AI agent handle routine deployment work without giving it a borrowed human login or unlimited authority. Tokay gives the agent its own identity, scoped credentials, and recovery boundaries that are checked on every API request.
Last updated
Give the agent only the access it needs
You can define what the agent may operate before handing it a credential. Add the agent as a named Workspace identity, assign only the Projects it needs, and issue a token with explicit grants such as deploy or configure.
The effective authority is always the intersection of the identity's memberships and the token's grants. Revoking a token or removing a membership changes access on the next request.
Keep stored secrets out of the agent's reach
Tokay lets an agent set credentials needed by an application without making those values retrievable later. Secrets are write only through the API and are delivered only to running Services.
Each action records the agent identity and credential that performed it, so later review does not depend on reconstructing a shared login's history.
Limit the cost of a bad action
A failed deploy does not replace the healthy version because new releases receive traffic only after passing health checks. Deleted Projects, Code, Services, and databases go to a 30-day trash where they can be restored.
Database migrations run against a copy of production data first. Destructive changes pause for human confirmation, and the agent cannot waive that gate.
Give the agent an API it can operate directly
The agent can still complete the deployment job because every dashboard workflow is available through one GraphQL API. Responses state the next valid action, failures include typed diagnoses, and retries are designed to be idempotent.
Point your agent to app.tokay.io/llms.txt for the protocol. See deploy with an AI agent for the human facing workflow.
Tokay has a very generous free tier with no credit card. Get started.