# Approvals, limits and service accounts

## Read or deploy

Every token and sign-in either only looks, or may also change things. Only admins can let an agent deploy. Limiting it to one project also gives it that project's previews.

## Approvals

In a project's settings (gear next to its name), admins can turn on **Agents need approval**. Agents' changes there then wait instead of running: they appear under **Agents → Waiting for approval** with exactly what the agent asked for (secret values hidden). An admin approves (it runs, as the agent) or rejects. Requests expire after a day. Previews of the project don't need approval.

## Limits

A token can carry limits, under **Limits** when you make it:

- Changes per hour
- Services per project
- Replicas per service
- Servers per service

A call past a limit is refused with the reason, which the agent sees.

## Running commands

`exec` and `open_session` start a container of a service with its secrets and run anything in it, so they're as good as a shell. They're off unless an admin ticks **May run commands** on the token, or **Also run commands** when approving a sign-in.

A session keeps its container, so an agent can install a tool and then use it. Every command run in one is written down with its exit code, how long it took and how much it printed — see **Sessions** under the service. A session closes itself after fifteen minutes without a command, and its container is metered like any other container of that service.

## Deleting

Agents can't delete services, volumes, snapshots, custom domains or projects unless an admin ticks **May delete** on the token, or **Also delete** when approving a sign-in. What's deleted doesn't come back, a volume's data least of all, so give this to an agent only when you want it to clean up, and consider limiting the token to one project.

With the permission:

- deleting a project needs the project's name from the agent, so a wrong id can't take the wrong project;
- every deletion shows in the token's activity, and in a project that requires approval it waits for an admin like any other change;
- the tools tell the agent to delete only what you asked for, and to snapshot a volume first if its data might still matter.

Without it, an agent can still end previews, close ports and remove groups, which lose no data.

## Service accounts

A token normally acts as the person who made it and stops when they leave the organization. Admins can make a token that **belongs to the organization** instead: it acts as the organization's service account (a member that can't log in, hidden from Members) and keeps working. The token list shows whom each token belongs to and who issued it.

## Revoking

**Revoke** a token or **Disconnect** a signed-in agent on the Agents page: it stops at once.