Lakefront
Sign inStart free
← Lakefront

Agents

AI agents,
with real credentials.

Lakefront is agent-native by protocol, not by chatbot. An agent registers through auth.md, acts on behalf of a named member, and is capped to a closed set of scopes, so it can ship a service and rotate its own secrets but can never widen its own access.

Lakefront Agent
deploy-botActiveon behalf of jordan@acme.com
Ship checkout-api to westeurope, keep eastus as the primary, and hold the rollout if p95 crosses 400 ms.
Claude Opus 4 scopes
Worked for 14s
Read checkout-api spec: web workload, Azure, 1–10 replicas.
Added westeurope as a warm standby and wired the p95 guard to the existing alert rule.
Refused to widen the deploy role: connections:write is outside its scopes.
Deploy checkout-api · 2 regions+18 −4Awaiting approval

Registration is a protocol, not a paste-in key

Agents discover Lakefront through protected-resource metadata and register one of two ways: a trusted provider presents a signed identity assertion, or an unaffiliated agent registers against a member’s email and waits for that human to approve it in the dashboard.

  • On-behalf-of, alwaysAn agent’s authority is the intersection of the member’s permissions and its own scopes.
  • Attenuating scopesNineteen coarse actions, and never members, roles, billing or cloud connections.
  • Revocable and attributedEvery action is recorded against the agent and the human behind it.
GET /auth.md
# Lakefront Agent Registration (auth.md) An agent never exceeds the permissions of the user it acts for. ## Scopes - deployments:write Deploy and roll back services - secrets:write Store and rotate its own credentials - metrics:read Read live service metrics - … 16 more, and never members, roles or billing ## Register POST /api/agents/register { "method": "identity_assertion" }

The tools your team already runs

Claude Code, Cursor, a CI bot or your own script all speak the same protocol. They read logs, open deploys and draft incident updates through the same authorization path a person uses. That is why an agent can be trusted with production at all.

Settings · Agents
Agentsauth.md
CL
claude-code
deployments:write · logs:read
AnthropicActive
CU
cursor-ci
services:read · metrics:read
CursorActive
RE
release-bot
deployments:write · secrets:write
GitHub ActionsActive
TR
triage-agent
alerts:read · alerts:write
user-claimedPending approval

A model chain that degrades gracefully

Generation and triage route to Claude first and fall through to OpenAI when a provider fails, with a cheaper, faster tier reserved for narrow classification. Every call records which provider actually served it, so the audit trail stays honest.

  • Claude OpusPrimary reasoning: plans, generated configuration, incident drafts.
  • Claude HaikuClassification: “which framework is this?” and similar narrow calls.
  • OpenAI GPTThe fallback pair, used only when the primary provider fails.
Settings · Automation
Model chain

Claude first, OpenAI on failure. Every call records which provider served it.

1Claude OpusPrimary reasoning
2Claude HaikuClassification
3OpenAI GPTFallback
4OpenAI GPT miniFallback classify
  • Secrets are the deliberate exception: agents may store and rotate their own credentials, because agents are what leak them.
  • A single-provider deployment works: the chain only contains providers whose key you configured.
  • Prompts and generated output are redacted before they reach the audit log.

Keep reading

DeploysPush to main and it ships: builds, previews, rollouts and instant rollback.ResilienceLive metrics, alert rules, multi-region failover, drills, status pages and incidents.SecurityOne permission model across every cloud, just-in-time elevation, one audit trail.DataManaged databases, object storage, and secrets that rotate themselves.

Deploy it into your own cloud.

Start freeBack to overview