Vercel published a detailed account of the permission architecture behind its AI agent's access to production systems. The core problem: agents need enough access to do useful work, but production access is dangerous, and a mistake is hard to undo. Vercel's answer is a layered grant system where the agent holds only the narrowest access its current task requires, and humans set those bounds before the agent starts.
The architecture separates read access from write access, and scopes both to specific resources rather than broad roles. A human grants the agent a token that expires, covers a named project, and lists permitted actions. The agent cannot escalate its own access. If the agent needs more, it stops and asks. That request surfaces in the product as a decision for the human, not a background negotiation.
For UX teams, the design lesson is sequencing. Trust is granted before work starts, not assumed during it. The human sees the scope of what they are granting, makes a choice, and can see or revoke that grant later. The agent's identity is visible in the audit log, distinct from human actions. This gives teams a concrete model for the permissions pattern: the human sets the envelope, the agent works inside it, and the record shows both.