Vercel Agent uses scoped plans to limit production access

Details

Vercel Agent separates investigation from execution by running read-only checks automatically, then proposing a plan that details the intended work and required permissions for user approval.
Access is controlled via scopes (e.g., read:deployment, read-write:deployment), where approving a plan grants a token containing the read-only baseline plus the specific approved scopes, enforced by Vercel APIs on every request.
The agent operates within the user's existing permissions; it cannot access resources the user does not own, and tokens are shorter-lived and tied to the active plan state.
A shared scope registry validates plans at creation, approval, and token preparation stages to reject outdated or malformed permission requests before execution.
Security relies on scoped credentials alongside sandbox isolation, network policies, and audit logs to mitigate risks from wrong decisions or malicious instructions in content like build logs.

Key point