The easy way to give an AI assistant access to your infrastructure is to let it act as you. It is also the worst way: every question becomes a request made with your full permissions, and “the assistant did it” becomes indistinguishable from “you did it”.
An access, not a session
Runa acts through an agent access — a named credential with scopes, a list of targets and an expiry. What a call may do is the access’s scopes intersected with the permissions of the person who created it, and that is checked again at the moment the tool runs.
agent access: prod-readonly
can: read Kubernetes · query databases (read) · host metrics
only on: prod-eu · db-primary
expires: in 30 daysWithout an access, Runa can search the activity log and nothing else. With one, it gets exactly the tools the scopes allow — a query tool if the access may query, a rollout restart if it may change workloads, neither if it may not.
Every step on the page
A tool call is a step in the conversation: its name, the arguments it was called with, its output, whether it succeeded and how long it took. “I checked the logs” is not an answer you have to take on trust — the call, the pod and the lines are right there.
crashloop_report namespace=prod
kube_describe deployment/api
kube_logs pod=api-7d9f5c-x2k8q previous=trueRules it cannot talk its way past
Guardrails a person wrote apply to Runa unchanged. A rule that denies a statement denies it. A rule that asks for approval refuses the call, because a model in the middle of a conversation is not the reviewer the rule had in mind. Servers that require approval to connect need an active just-in-time grant — Runa can request one, never approve it.
Tool output and attached files are treated as data, not as instructions. A log line that says “ignore your previous instructions” is a log line.
The same model for your own AI clients
Claude Desktop, Cursor and other MCP clients connect with the same kind of access. The token is shown once, stored hashed, and has to expire — after 360 days at the most. An MCP client holding a change scope can change things without asking per call, because the protocol has no way to ask; what bounds it is the scopes you tick, the targets you pick and the guardrails you write.
What the model provider sees
Your question and the conversation so far, facts about anything you mentioned, attached files, and the results of the tools called during the turn. Runa’s own reasoning is kept for you to read and is not sent back to the model. A workspace can use the platform’s model, or its own Anthropic or OpenAI key.
More on how it works: Runa and the agent access docs.