An access profile is a named permission set that defines exactly what an agent is allowed to access. Every agent in Gazebo must be linked to an access profile — there is no default access.
Structure
An access profile contains one or more service entries, each specifying:
- Service — which connected service (e.g. Stripe, GitHub)
- Allowed methods — which HTTP methods the agent may use (
GET,POST,PUT,PATCH,DELETE)
Example profile — payment-reader:
| Service | Allowed methods |
|---|---|
| Stripe | GET |
| GitHub | GET |
An agent with this profile can read from Stripe and GitHub. It cannot write to either, and it cannot touch any other service you have connected.
Creating a profile
Profiles are created as part of the agent creation flow:
- Go to Agents → New agent
- Under Access, click Add service
- Select the service and the methods the agent needs
- Repeat for each service
- Save the agent — the profile is created automatically
Editing a profile
You can add or remove services and methods from an existing profile at any time. Changes take effect immediately — the next get_credential call from that agent uses the updated policy.
Least privilege
Scope each profile to the minimum the agent actually requires. An agent that only reads Stripe payment data should not have POST access — even if it never uses it. The audit log will flag any credential access beyond what the observed usage requires.
One profile per agent
Each agent is linked to exactly one access profile. If you have multiple agents with the same access needs, they can reference the same profile — or you can create separate profiles for independent revocation control.
Revocation
Deleting an agent immediately revokes access for all credentials in its profile. The bearer token stops working. No credential rotation required.