Investigate a production incident

An on-call agent that looks at production when something breaks. It reads the status of every service, the deployment history and the logs, and reports what changed and what it thinks the cause is. It cannot change, deploy or delete anything. Level: Read only. See all the agent policy examples.

What the agent does

Finds the failing service in the production environment.
Reads its status, its recent deployments and the environment logs.
Compares the failing deployment with the last healthy one.
Writes a short report: what broke, when, the likely cause, and the fix it suggests to a human.

What the policy allows

The agent can

Find the organization, project and environment by name, as the Qovery CLI does
Read the production environment: services, status, deployment history and logs

The agent cannot

Read environment variable values, even in production
Deploy, redeploy, restart or stop anything
Change any configuration, or delete anything
Read any other environment

Anything the policy does not allow is refused with 401 Unauthorized.

The policy

Copy it, then replace each REPLACE_WITH_... value with a real ID from your organization.

investigate-production-incident.rego

default allow := false

organization_id := "REPLACE_WITH_ORGANIZATION_ID"
project_id := "REPLACE_WITH_PROJECT_ID"
production_environment_id := "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"

allow if cli_lookup
allow if read_production

# Let the Qovery CLI find the organization, project and environment by name.
cli_lookup if {
	input.request.method == "GET"
	input.request.path in {
		["api", "organization"],
		["api", "organization", organization_id],
		["api", "organization", organization_id, "project"],
		["api", "project", project_id],
		["api", "project", project_id, "environment"],
	}
}

# Read production: services, status, deployment history and logs.
# Environment variables are left out, because their values can be sensitive.
read_production if {
	input.request.method in {"GET", "HEAD"}
	input.qovery_metadata.environment_id == production_environment_id
	not "environmentVariable" in input.request.path
}

Value	What to put
`organization_id`	your organization
`project_id`	the project that holds production
`production_environment_id`	the production environment

You can copy the IDs from the Console URL, or list them with qovery project list, qovery environment list and qovery application list.

Create the token

With the coding agent
In the Console

In a session signed in as an organization Owner or Admin, ask:

/qovery-policy-token read-only access to the production environment of my project, including logs and deployment history, but not environment variables. No writes, no deploys, no deletes.

The qovery-policy-token skill finds the IDs, writes a policy like the one above, tests it locally and against the API, then creates the token.

Open your organization settings, then Token API.
In Policy API Token, click Add new.
Enter a name and a description, and paste the policy with your IDs.
Copy the token (sk-qov-01-...). It is shown once.

Prompt for the agent

The agent runs with the Qovery Agent Skills and the Qovery CLI, in Claude Code, Codex, Cursor or any agent that supports skills. Give it the token through the environment, never in the prompt:

export QOVERY_CLI_ACCESS_TOKEN="sk-qov-01-..."

Then give the agent its task:

Our production checkout service started failing about 20 minutes ago.
Use Qovery to investigate. The project is "shop" and the environment is "production".

1. Find which services are not healthy and since when.
2. Read the deployment history and the logs of the failing services.
3. Compare the last failing deployment with the last healthy one.
4. Give me a short report: what broke, the most likely cause, and the fix you suggest.

Do not try to change or redeploy anything. Your token only allows reads.

Every call the agent makes appears in the audit logs as policy:<token-id>:<token-name>.

Good to know

This is the safest place to start: the token cannot change production, so you can give it to an agent on day one.
If you also want the agent to read logs through the Qovery MCP Server, use an API token with a read-only role for the MCP Server. It does not accept API Policy Tokens.

All agent policy examples

Every use case, from read only to production changes.

API Policy Token (Preview)

How policies are evaluated, the input they see, and the limits.

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

Investigate a production incident

What the agent does

What the policy allows

The agent can

The agent cannot

The policy

Create the token

Prompt for the agent

Good to know

All agent policy examples

API Policy Token (Preview)

​What the agent does

​What the policy allows

The agent can

The agent cannot

​The policy

​Create the token

​Prompt for the agent

​Good to know

​Related

All agent policy examples

API Policy Token (Preview)

What the agent does

What the policy allows

The policy

Create the token

Prompt for the agent

Good to know

Related