> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent policy examples

> Ready-to-use API Policy Tokens for autonomous infrastructure agents: each example gives the use case, the full policy, the prompt, and what the agent can and cannot do.

These examples show AI agents doing real DevOps work on their own, each with an [API Policy Token](https://www.qovery.com/docs/configuration/organization/api-policy-token.md) (Preview) that allows exactly that job and nothing else. Qovery checks the policy on every API request the agent makes, through the CLI or the API. So the agent does not need a human to approve each action, and anything outside the job is refused.

Each page gives you:

* the use case, and what the agent does step by step,
* what the policy allows and what it blocks,
* the full policy, ready to copy,
* a prompt to create the token with the `qovery-policy-token` skill,
* a prompt to give the agent its task.

## Examples

Start at the top. The first jobs only read or touch non-production environments. The last ones change production, in a narrow way.

| Example | Level | What the agent does |
| - | - | - |
| [Investigate a production incident](https://www.qovery.com/docs/configuration/organization/policy-examples/investigate-production-incident.md) | Read only | Reads production status, deployment history and logs, and reports the cause. Changes nothing. |
| [Fix a bug and verify it in a preview environment](https://www.qovery.com/docs/configuration/organization/policy-examples/fix-in-preview-environment.md) | Previews | Reads production, then deploys and checks a fix in the pull request's preview environment. |
| [Stop idle environments](https://www.qovery.com/docs/configuration/organization/policy-examples/stop-idle-environments.md) | Hygiene | Stops listed dev and QA environments when idle, and starts them again. |
| [Clean up preview environments](https://www.qovery.com/docs/configuration/organization/policy-examples/clean-up-preview-environments.md) | Hygiene | Deletes previews whose pull request is merged, closed or idle. Never production or staging. |
| [Right-size applications](https://www.qovery.com/docs/configuration/organization/policy-examples/right-size-applications.md) | Cost | Sets CPU and memory from real usage, within bounds, then redeploys. |
| [Scale before a traffic peak](https://www.qovery.com/docs/configuration/organization/policy-examples/scale-before-traffic-peak.md) | Reliability | Adds instances before a known peak and removes them after, between a floor and a ceiling. |
| [Roll back a bad release](https://www.qovery.com/docs/configuration/organization/policy-examples/roll-back-bad-release.md) | Reliability | Deploys the last healthy version when a release goes wrong. |
| [Test on a copy of production](https://www.qovery.com/docs/configuration/organization/policy-examples/test-on-production-clone.md) | Change | Clones production into a sandbox, runs tests on the copy, and deletes it. |
| [Patch a security issue](https://www.qovery.com/docs/configuration/organization/policy-examples/patch-security-issue.md) | Change | Tests a security fix on a copy of production, then deploys the patched commit. |

## How to use an example

**1. Copy the policy and replace the IDs**

Every value that starts with `REPLACE_WITH_` is an ID from your organization: organization, project, environment, application or cluster. Copy them from the Console URL or list them with the [Qovery CLI](https://www.qovery.com/docs/cli/overview.md).

**2. Create the token**

In the Console, open your organization settings, then **Token API**, then **Add new** in **Policy API Token**, and paste the policy. Or ask a coding agent with the `qovery-policy-token` skill, using the prompt on the page. Only an organization Owner or Admin can create a policy token.

**3. Give the token to the agent**

Set it in the agent's environment, never in the prompt:

```bash theme={null}
export QOVERY_CLI_ACCESS_TOKEN="sk-qov-01-..."
```

The agent uses the [Qovery Agent Skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) and the Qovery CLI.

**4. Give the agent its task**

Use the prompt on the page, adapted to your project and environment names.

## What every policy has in common

* **Deny by default.** Each policy starts with `default allow := false`. A request is allowed only if one rule says so.
* **A rule for CLI lookups.** The Qovery CLI turns names into IDs by listing the organization, its projects and the project's environments (and its clusters, for the examples that clone). The `cli_lookup` rule allows those reads and nothing more.
* **No environment variable values.** The read rules leave out `environmentVariable` endpoints, because values can be sensitive. Remove that line if your agent needs them.
* **One scope per job.** Each rule is tied to an environment, a project, or a list of services, so the agent cannot reach anything else.

## Test a policy before you create the token

A denied request returns `401` with no detail, and a policy cannot be edited after creation. Test it first with [OPA](https://www.openpolicyagent.org/docs#running-opa). Add a temporary `package` line, then evaluate it against a request:

```bash theme={null}
(echo "package test"; cat policy.rego) > /tmp/policy.rego

cat > /tmp/input.json <<'EOF'
{
  "request": { "method": "DELETE", "path": ["api", "environment", "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"], "body": null },
  "qovery_metadata": {
    "organization_id": "REPLACE_WITH_ORGANIZATION_ID",
    "service_id": null, "service_type": null,
    "environment_id": "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID",
    "project_id": "REPLACE_WITH_PROJECT_ID",
    "cluster_id": null
  },
  "token": { "id": "test", "name": "test" }
}
EOF

opa eval -d /tmp/policy.rego -i /tmp/input.json 'data.test.allow'
```

The result must be `false` for every action the agent must not do. Do not submit the `package` line: Qovery adds its own. The [Rego Playground](https://play.openpolicyagent.org/) works too. The `qovery-policy-token` skill runs these tests for you, then checks the token against the real API.

## Related

> [card] [API Policy Token (Preview)](https://www.qovery.com/docs/configuration/organization/api-policy-token.md)
>
> How policies are evaluated, the input document, recipes and limits.

> [card] [Let a coding agent deploy](https://www.qovery.com/docs/getting-started/guides/use-cases/coding-agent-deploy-access.md)
>
> Set up a coding agent with a scoped Qovery token.

> [card] [Securing AI agent access](https://www.qovery.com/docs/copilot/securing-ai-access.md)
>
> Read-only MCP, CLI allowlists and policy tokens compared.

> [card] [Agent Skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md)
>
> The skills the agent uses, including qovery-policy-token.


## Related topics

- [API Policy Token (Preview)](https://www.qovery.com/docs/configuration/organization/api-policy-token.md)
- [Investigate a production incident](https://www.qovery.com/docs/configuration/organization/policy-examples/investigate-production-incident.md)
- [Stop idle environments](https://www.qovery.com/docs/configuration/organization/policy-examples/stop-idle-environments.md)
- [Patch a security issue](https://www.qovery.com/docs/configuration/organization/policy-examples/patch-security-issue.md)
- [Test on a copy of production](https://www.qovery.com/docs/configuration/organization/policy-examples/test-on-production-clone.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.