Agents and approvals

Coding agents (Claude Code, OpenCode, Cursor, Codex or any MCP client) work on twins, not on production. The hub enforces this, not the client.

The agent principal Gebaut

• A device registers one agent key per agent integration (claude-code, cursor, mcp, …). It is a separate key without user presence, so an agent never uses the person’s key.
• A request signed with it is the agent’s, whatever the request says about itself. On Hetzner, an agent’s delete of production whose body and headers claimed to be a person still ended as a pending approval (stage-2 gate, 20 October 2026).
• Run vai in agent mode, or set the variable once in the agent’s environment:

vai --agent claude-code twin create --production shop --task fix-42
VAI_AGENT=claude-code vai twin list

ownpaas-mcp signs the same way for MCP clients. With VAI_AGENT set, vai never falls back to the person’s key.

The ceiling

	what an agent may do
allowed	read clusters, environments, releases, operations, twins, recovery tests; create (with seed or empty data), extend, reset, reseed and delete twins; run recovery tests; developer access and SSH logins on twins
asks a person	delete a production or staging server, promote a release, admin access or an operate login on production or staging, a twin with a copy of production’s data
refused	devices and keys, pairing codes, the audit, settings, creating servers, setting environments, and the approvals themselves

An agent key of a viewer device can only read.

Approvals

When the ceiling says “ask”, the hub does not run the call. It records it and answers 202 with an approval; vai exits with code 5 and prints its id.

• A person approves on a device of level presence, with the resource’s name typed and a signature of the operation’s digest by the device’s signing key (Touch ID on a Mac, a PIN with a TPM). Then the hub runs the recorded request once, exactly as the agent sent it.
• An approval expires after 15 minutes. On Hetzner, an approval 987 s after the ask was refused as expired (20 October 2026).
• Nothing approves through an agent key, an API key, MCP or the browser: the portal shows approvals but has no form, because a browser session holds no signing key.

$ vai approvals
$ vai approve ap-3f9c… --confirm shop

Approvals from your phone, with Face ID and a push notice, are Geplant in the Vaicoa app.

Agent servers and agent runs

• In Arbeit Sandboxed agent servers. NVIDIA’s OpenShell was tested as the sandbox on a disposable cloud server: ready 78 s after the server was created, about €0.17 for the lab run; the sandbox held only a placeholder for its credential, which worked at one endpoint only, and every other egress was refused (lab, 23 October 2026).
• Geplant Agent runs: the hub notices a problem, starts a twin and a disposable agent server, and the agent opens a pull request for a person to decide. Designed, not built.
• Geplant Hosted runs with Claude Code in the cloud.

Every agent call lands in the audit with its principal, integration and session.