Ties approval to a reviewed plan instead of per-action prompts, so agents investigate with read-only scopes and need one explicit grant for changes. A pattern you can reuse for agent authorization.
Key takeaways · AI-distilled
Vercel AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition →'s read-only baseline is every registered scope beginning with 'read:'. A plan needs explicit approval when it requests access beyond that or includes a supported external action such as opening a GitHub pull request, and it is approved as a whole.
Approval cannot exceed the user's rights: the agent runs as a Vercel App limited to the user's existing permissions, and OAuth issues shorter-lived scoped tokenThe chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.Full definition → that Vercel APIs check on every request, rejecting out-of-scope calls even if the model thinks they are needed.
Vercel notes scopes are coarser than plans: naming deployment X does not restrict a deployment-write token to X. Before using an approved credential, the runtime checks that the plan is still active, so a stopped plan fails even when its token has not expired.
Vercel first kept a separate permission list for the agent, which could fall out of sync with the OAuth service, so plans are now validated against the shared scope registry. Unknown or outdated scopes are rejected with valid alternatives instead of a fallback to broader access.
Vercel stresses read-only is not harmless: automatic reads can expose sensitive configuration, and build logs can carry malicious instructions. Scoped plans therefore sit alongside sandboxAn isolated environment where AI-generated code or agent actions run without being able to touch anything real.Full definition → isolation, network policy, secret handling, rate limits and audit logs.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.
sandbox — An isolated environment where AI-generated code or agent actions run without being able to touch anything real.
