Who Gives the Agent Production Access? My Talk at Alan's Second Opinion in Paris

At Alan’s Agents in Production event in Paris, Qovery CEO Romaric Philogene argued that requiring human approval for every AI-agent infrastructure change can be slow and unreliable, citing high approval rates for permission prompts and incidents in which overly privileged agents deleted production data. He proposed replacing broad, human-oriented roles with narrowly scoped API Policy Tokens, which use Rego policies and are evaluated on every Qovery API request across the console, CLI, Terraform provider, and MCP server, with actions separately logged for auditability. The approach is intended to let agents autonomously perform specific approved tasks while blocking unrelated or destructive actions, though it still requires sound policies, testing, and rollback processes because permitted actions can still be mistaken. Philogene recommended progressively expanding agent autonomy from low-risk cleanup and cost optimization to testing against production copies, reliability actions, and security patches, with each agent receiving only the permissions needed for its defined task.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.