---
title: "Access Profiles | Gazebo Docs"
description: "Create and manage agent access profiles — scope which services an agent can reach and which HTTP methods are permitted."
url: "https://gazebohq.com/docs/access-profiles"
---

An access profile is a named permission set that defines which credentials Gazebo may release to an agent. Every agent in Gazebo must be linked to an access profile — there is no default access.

## Structure

An access profile contains one or more service entries, each specifying:

- **Service** — which connected service (e.g. Stripe, GitHub)
- **Release methods** — which declared HTTP methods permit credential release (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`)

Example profile — `payment-reader`:

| Service | Release methods |
|---|---|
| Stripe | GET |
| GitHub | GET |

An agent with this profile can request Stripe and GitHub credentials when it declares `GET`. Gazebo denies credential requests for other methods and services.

This is a credential-release boundary, not a proxy around the provider API. After release, the provider's own key scopes, OAuth scopes, or IAM permissions determine which operations succeed.

## Creating a profile

Profiles are created as part of the agent creation flow:

1. Go to **Agents → New agent**
2. Under **Access**, click **Add service**
3. Select the service and the methods the agent needs
4. Repeat for each service
5. Save the agent — the profile is created automatically

## Editing a profile

You can add or remove services and methods from an existing profile at any time. Changes take effect immediately — the next `get_credential` call from that agent uses the updated policy.

## Least privilege

Scope each profile to the minimum the agent actually requires. If an agent only reads Stripe payment data, permit credential release for `GET` and use a provider credential that cannot write. The audit log records Gazebo credential requests; it does not observe later Stripe API calls.

## One profile per agent

Each agent is linked to exactly one access profile. If you have multiple agents with the same access needs, they can reference the same profile — or you can create separate profiles for independent revocation control.

## Revocation

Deleting an agent immediately revokes access for all credentials in its profile. The bearer token stops working. No credential rotation required.