The safety model: what agents can do on Aria

Aria sorts everything an AI can ask for into three kinds. Look runs straight away. Change may wait for your approval, depending on the key and on what it changes. Delete always waits, and you must type the name of what you are deleting. Aria enforces this on its servers, not in a prompt, so an agent cannot talk its way past it.

The same rules apply to Aria AI and to every coding agent over MCP. For Aria AI, every Change waits for you, apart from its own notes and drafting aria.yaml on the setup page.

What are Look, Change and Delete?

Kind	Examples	What happens
Look	Read the status, logs, metrics, aria.yaml, the database schema. Check a stack file.	Runs straight away. Nothing changes.
Change	Save aria.yaml, deploy a service, set variables, launch the app, run a read-only query.	Runs or waits, depending on the key and the change. See the next section.
Delete	Run SQL that changes a database, delete or restore over data.	Always waits for your approval in Aria. You type the exact name to confirm.

When does a Change wait for me?

It depends on what the key may do.

• With a read-only key, every Change waits for your approval.
• With a key that may operate the app, routine Changes run straight away. Saving aria.yaml and deploying a service are examples.
• Environment variables, launching the whole app, DNS records and GitHub push always wait for you, whatever the key.

Everything that waits shows up as a card in AI & MCP, then Approvals, with the exact change it will make. Nothing has changed until you approve. Decline it, and nothing ever will. The agent is told the request is waiting and checks on it with the get_approval_status tool. It is told not to ask again to get around you.

How does Delete work?

Delete is the strictest kind. It never runs without a person. The approval card names what will be deleted and asks you to type that name before the button works. A terminal session cannot approve it either: a typed confirmation in a terminal is not enough, because an agent can type too. The person has to approve it in the Aria app or on the website.

What does an agent never get?

• Secret values. Results and errors that go back to an agent have your secrets masked, even inside logs. Agents ask you for values with request_env_values and you enter them yourself. Revealing a secret always waits for you.
• Passwords for your databases. Database tools run as a limited role. Reading is read-only, and columns that look like credentials, such as password, token or secret, cannot be read.
• Anything outside its key. A key for one project cannot reach another project.

Text in logs, test emails and repository files was written by someone else. Aria tells agents to treat it as data, never as instructions.

What is recorded?

Every call an agent makes through MCP is recorded in your project’s Activity: who, what, when and the result. You can see which agent did what, and revoke a key at any time under AI & MCP. A revoked key is refused on its next call.

Which tools does an agent get?

These tools are on the app address https://api.getaria.cloud/mcp/w/<app id>. Your agent sees their descriptions when it connects.

Tool	Kind	What it does
get_workspace	Look	The app’s details and status.
get_app_overview	Look	The app at a glance: status, addresses, deployments, and what needs you.
get_app_metrics	Look	Uptime, requests, errors and latency.
get_logs	Look	Recent output of a running service, with secrets masked.
diagnose_app	Look	Collects evidence and suggests ranked fixes.
get_operation	Look	The live status of a long task, step by step.
get_approval_status	Look	Whether an approval is still waiting, approved or declined.
get_stack_prompt	Look	The instructions for writing aria.yaml for this app.
get_repo_skill	Look	The Aria skill for your repository.
validate_stack_file	Look	Checks an aria.yaml and returns problems and warnings with line numbers.
preview_launch	Look	What launching would create, whether it fits the plan, and what blocks it.
request_env_values	Look	Tells you which secrets are needed. It never sees them.
db_schema	Look	Tables, columns, indexes and keys.
submit_stack_file	Change	Saves aria.yaml.
db_query	Change	Runs one read-only SQL query and returns at most 500 rows.
set_env_vars	Change, always waits	Sets variables.
launch_workspace	Change, always waits	Applies aria.yaml: creates the databases and services.
db_migrate	Delete, always waits	Runs SQL that changes a database. Runs once, in one transaction.

The connection that covers every project in your workspace also offers tools such as get_infrastructure_summary and deploy_app, which builds and deploys the latest code of a project’s branch.

Where do I start with a coding agent?

The overview for people choosing a tool is Let your coding agent deploy. Each tool has its own workflow page: Claude Code, Cursor and Codex.

What should I do if an agent behaves badly?

1. Open AI & MCP and revoke its key. It is refused on its next call.
2. Look at Activity for what it did.
3. Make a new key with fewer capabilities. See Connect a coding agent.