The Ability Gateway

Give one engineer query access to the production database, and an AI agent the ability to file Linear issues, without either being able to touch anything else. The Ability Gateway is how you hand out exactly the access each person and agent needs, watch every use of it, and take it back the moment you want to.

Grants. Developer → Permissions is where access lives. Grant a single ability, such as reading databases in PlanetScale, or a permission set that bundles abilities under a name like Database read-only. Scope any grant to specific environments, so one person reaches only Development while another reaches Production too. A grant can also carry an expiry date and end on its own.

Nothing inherited. Service keys start with no access at all. An agent or script holds exactly the grants you gave it, never the reach of the person who created it. Revoking takes effect immediately.

Approvals. Actions you mark as high risk do not run on a grant alone. They wait in Developer → Approvals, where an admin approves or denies them with full context of who asked and what they asked for.

The activity ledger. Every attempt is recorded in Developer → Activity before it runs, allowed or denied. When something was refused, the ledger shows what was asked and why it did not happen.