Giving an AI agent access to production infrastructure is a very different problem from giving it access to a codebase.

@NuphosAI (AI-Native DevOps Workspace) approaches this by making the cloud's own permission system the hard boundary.

The agent assumes AWS IAM roles or GCP service accounts like another team member, then teams can narrow access further by session and require human approval before sensitive actions execute.

The agent can collect logs, metrics, deploy history, Kubernetes state, cloud resources and previous incident context, then propose what should happen next.

Sensitive actions can sit behind human approval, while the underlying access is still constrained by native IAM roles or service accounts.