Access profiles
An access profile is a named permission set that defines which credentials Gazebo may release to an agent. Every agent in Gazebo must be linked to an access profile — there is no default access.
Structure
An access profile contains one or more service entries, each specifying:
- Service — which connected service (e.g. Stripe, GitHub)
- Release methods — which declared HTTP methods permit credential release (
GET,POST,PUT,PATCH,DELETE)
Example profile — payment-reader:
| Service | Release methods |
|---|---|
| Stripe | GET |
| GitHub | GET |
An agent with this profile can request Stripe and GitHub credentials when it declares GET. Gazebo denies credential requests for other methods and services.
This is a credential-release boundary, not a proxy around the provider API. After release, the provider's own key scopes, OAuth scopes, or IAM permissions determine which operations succeed.
Creating a profile
Profiles are created as part of the agent creation flow:
- Go to Agents → New agent
- Under Access, click Add service
- Select the service and the methods the agent needs
- Repeat for each service
- Save the agent — the profile is created automatically
Editing a profile
You can add or remove services and methods from an existing profile at any time. Changes take effect immediately — the next get_credential call from that agent uses the updated policy.
Least privilege
Scope each profile to the minimum the agent actually requires. If an agent only reads Stripe payment data, permit credential release for GET and use a provider credential that cannot write. The audit log records Gazebo credential requests; it does not observe later Stripe API calls.
One profile per agent
Each agent is linked to exactly one access profile. If you have multiple agents with the same access needs, they can reference the same profile — or you can create separate profiles for independent revocation control.
Revocation
Deleting an agent immediately revokes access for all credentials in its profile. The bearer token stops working. No credential rotation required.