How Vercel Agent accesses production safely

Vercel's AI agent for fixing broken deployments investigates with read-only access, then asks a person to approve one plan, avoiding the reflexive clicking that step-by-step prompts cause.

Vercel, a company that hosts and deploys websites and web applications, makes an AI agent that investigates and fixes problems in production deployments. Tom Dale explains the problem the team faced: broad access lets a mistake reach unrelated resources, while approving every step turns review into a habit. Vercel chose to have the AI agent investigate first and then request all the access a fix needs in one plan.

• Read-only investigation runs without approval, but any plan that needs more access, or that opens a GitHub pull request, waits for a person to approve it as a whole.
• Approved work receives short-lived credentials limited to the plan's named permissions and to the approving person's own access.
• GitHub access is tied to one repository, so approval in one repository does not cover another.
• Each stored plan records who approved it and when, and a stopped plan cannot resume even if its credential has not expired.

A team giving an AI agent access to production can ask for approval of the whole plan, after the investigation, instead of approving each action. This is Vercel's account of its own product, and the post reports no measured results.

Derived by Working Surface from the article; more in the Playbook. Source line: Repeated prompts can turn that review into a habit of clicking approve.

24 October 2026: teams keep the time AI saves only when they decide in advance what an AI agent may do alone, what waits for a person and who maintains what it builds.