Every token and sign-in either only looks, or may also change things. Only admins can let an agent deploy. Limiting it to one project also gives it that project's previews.
In a project's settings (gear next to its name), admins can turn on Agents need approval. Agents' changes there then wait instead of running: they appear under Agents → Waiting for approval with exactly what the agent asked for (secret values hidden). An admin approves (it runs, as the agent) or rejects. Requests expire after a day. Previews of the project don't need approval.
A token can carry limits, under Limits when you make it:
A call past a limit is refused with the reason, which the agent sees.
exec and open_session start a container of a service with its secrets and run anything in it, so they're as good as a shell. They're off unless an admin ticks May run commands on the token, or Also run commands when approving a sign-in.
A session keeps its container, so an agent can install a tool and then use it. Every command run in one is written down with its exit code, how long it took and how much it printed — see Sessions under the service. A session closes itself after fifteen minutes without a command, and its container is metered like any other container of that service.
Agents can't delete services, volumes, snapshots, custom domains or projects unless an admin ticks May delete on the token, or Also delete when approving a sign-in. What's deleted doesn't come back, a volume's data least of all, so give this to an agent only when you want it to clean up, and consider limiting the token to one project.
With the permission:
Without it, an agent can still end previews, close ports and remove groups, which lose no data.
A token normally acts as the person who made it and stops when they leave the organization. Admins can make a token that belongs to the organization instead: it acts as the organization's service account (a member that can't log in, hidden from Members) and keeps working. The token list shows whom each token belongs to and who issued it.
Revoke a token or Disconnect a signed-in agent on the Agents page: it stops at once.