Documentation

Coding-agent deploy approvals

Step-by-step demo: Claude Code or Codex attempts a production deploy, BehalfID blocks it, you approve in the dashboard, the agent retries and succeeds.

Overview

This guide walks through the complete approval loop for a coding agent that can deploy to staging freely but requires human approval before touching production.

Step 1: Set up two permissions

terminal

behalf permissions create agent_xxx \
  --action deploy --resource vercel.com \
  --blocked "deploy to production"

behalf permissions create agent_xxx \
  --action deploy_production --resource vercel.com \
  --requires-approval

Step 2: Wire up MCP enforcement

terminal

behalf mcp init && behalf claude

Step 3: Agent attempts production deploy — blocked

what the agent sees

APPROVAL REQUIRED — do not execute this action.

Action:      deploy_production on vercel.com
Approval ID: apr_Def456uvw

Approve at: https://behalfid.com/dashboard/approvals

Step 4: Approve and retry

Click Approve in the dashboard. The agent calls verify_action again — now allowed: true. The deploy runs. Every step is in the audit log.