The agent can investigate with a read-only baseline, then propose a plan listing the work and the scopes needed for actions that require more authority. A redeploy, for example, requires approval for deployment write access.
The company says approval results in short-lived OAuth tokens containing the read-only baseline plus the approved permissions. Vercel APIs check scopes on each request, while the runtime checks that a stored plan is active before selecting an approved credential. An agent cannot receive permissions beyond those held by the user who authorized it. External actions use separate provider credentials; Vercel cites GitHub pull-request access tied to a specific owner and repository.
Plans store tasks, requested scopes, progress, approver, and state, so resumed work must still be associated with an active approved plan. Vercel also says it now uses the same scope definitions for planning and token issuance, rejecting unknown or malformed scope names before a plan is approved.
The post does not provide independent testing, token lifetimes, a complete scope list, or evidence that the controls prevent every unsafe action. Vercel notes that read-only access may still expose sensitive information and that valid scopes can be broader than an individual task.