> ## Documentation Index
> Fetch the complete documentation index at: https://docs.doploy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and safety

> How connected apps are controlled: per-app deploy switch, project scope, per-project opt-in, production confirmation, revoke

# Permissions and safety

A connected app never holds a password or a long-lived secret with fixed powers. Its token proves
who you are; what it may do is looked up on every request. That is why every control below takes
effect immediately, without reconnecting the app.

## Settings → Connected apps

<Frame>
  <img src="https://mintcdn.com/doploy/72CKAeD-J8JE4APL/images/agents/connected-apps.png?fit=max&auto=format&n=72CKAeD-J8JE4APL&q=85&s=270318a3525b26a482c0413fecd93d18" alt="Connected apps list with deploy switches" width="812" height="1012" data-path="images/agents/connected-apps.png" />
</Frame>

One row per app. For each you can:

* **Toggle Deploy.** Off means read only. On lets the app use the deploy tools.
* **Edit projects.** Limit the app to some of your projects. It will not see the others even
  though you can.
* **Revoke.** The app loses access on its next request and has to sign in again from scratch.

<Frame caption="Restricting an app to specific projects.">
  <img src="https://mintcdn.com/doploy/72CKAeD-J8JE4APL/images/agents/project-scope-dialog.jpg?fit=max&auto=format&n=72CKAeD-J8JE4APL&q=85&s=f9c3abf429a88b874eb0fcc0bdf3b85f" alt="Projects dialog for a connected app" width="1380" height="713" data-path="images/agents/project-scope-dialog.jpg" />
</Frame>

## Per-project opt-in

Deploy tools also require the project itself to allow agent writes. A project owner or
administrator turns that on in **Project Settings → General → Agent write access**. Until then,
every app is read only on that project regardless of its own switch.

<Frame>
  <img src="https://mintcdn.com/doploy/72CKAeD-J8JE4APL/images/agents/agent-write-access.png?fit=max&auto=format&n=72CKAeD-J8JE4APL&q=85&s=886523cc6296540df205f3ba7aa476fa" alt="Agent write access switch in project settings" width="1568" height="411" data-path="images/agents/agent-write-access.png" />
</Frame>

Two switches, two people: the person who connected the app decides whether *that app* may deploy;
a project admin decides whether *any* app may deploy on *that project*.

## Your role still applies

An app acts as you. If you are a read-only member of a project, no switch makes the app able to
deploy there. Owners, administrators and developers can.

## Production asks first

Rebuilding, restarting, updating modules on or backing up a **production** deployment always
returns `confirm_required`. The agent must call again with `confirm: true`. Well-behaved agents ask
you before doing that.

## What is never possible

No connected app can delete a project or deployment, restore a backup over a database, change
domains, manage servers, open a shell, or change billing. These are not gated; they do not exist
as tools.

## Audit

Every write made through an app appears in the project's audit log, attributed to the app and
the user who connected it.