How Vercel Agent accesses production safely: plan-scoped permissions
dl_weekly · x · 2026-11-02
Vercel engineer Tom Dale explains how Vercel Agent safely works on production systems.
The problem: a request like "fix this deployment" doesn't reveal upfront which actions or access it needs. Broad access risks blast radius; per-step approvals train users to mindlessly click approve.
The approach: the plan determines the permissions
- Investigation runs automatically with read-only access (e.g. diffing the failed deployment's build logs against the last known-good one);
- The agent then proposes a plan stating what it would do and what access it needs;
- Approving the plan in one decision mints a token carrying only the scopes each task declared, via Vercel's named-scope authorization system;
- Anything beyond read-only requires plan approval.
The pattern bundles fine-grained approvals into a single reviewable decision point before any change is authorized.
More from coding & agent
- Reward hacking is Goodhart's Law for agents, warns Morgan Brown — morganb · 2026-11-02
- Debate on agentic commerce monetization: do agents really need payments revenue? — jeff_weinstein · 2026-11-02
- Veynod: open-source agent coding runtime with one model loop and a deterministic kernel — TKOWNS · 2026-11-02
- Claude Code subagents silently switch to paid usage, burning $100 in credits — nptacek · 2026-11-02
- Instinct reportedly blocked from WhatsApp as observers say agent pivot was predictable — itsOmSarraf_ · 2026-11-02
- Purser: an MCP server that lets agents pay with smart-contract limits a jailbreak can't bypass — Plane-Preference6245 · 2026-11-02