AI agents · kubelatch

// the problem

Two bad options.

You're developer on shop and you ask your agent “find out why the web pod is failing”. Give it your kubeconfig, and it can do everything you can while the audit shows only you. Or ask an administrator for a bot and wait, which nobody does for a ten-minute task.

// delegated, in six steps

Like “Sign in with Google”, for your clusters.

You don't hand over your password: you give a limited permission you can take back.

Add kubelatch once
claude mcp add --transport http kubelatch https://kubelatch.example.com/mcp
Your browser opens
The first time the agent uses it, on kubelatch, where you're already signed in.
You choose, and authorize
“Claude Code wants to access your clusters”: your permissions, read-only, for 8 hours.
It reads, it doesn't break
Pods, logs, events. In a read-only session the cluster turns down any change it tries; if it needs more, it asks with request_access.
Changes wait for you
Give it your developer role with “Writes need my approval”, and every change it wants waits for you, with the diff.
It ends by itself
After 8 hours. Before that, Cut.

The authorization card: “Claude Code wants to access your clusters”, with a choice for each of ana’s two permissions (same role or read only), a duration of 8 hours and “Writes need my approval” on. — Step 3, as you’ll see it: for each permission of yours, what the agent gets; for how long; and whether its writes wait for you.

// what the agent sees

What it sees, and what waits for you.

What the agent sees

kubelatch MCP tools

› whoami
identity: user:sergio
session:
  id: 0199c1d0…
  mode: delegated
  expires_at: 2026-10-06T20:04:31Z
on_behalf_of: user:sergio
credential_expires_at: 2026-10-06T13:04:31Z
writes_need_approval: true
permissions:
  - cluster: prod-eu
    role: developer
    scope: shop
    expires_at: 2026-10-06T20:04:31Z
  - cluster: prod-eu
    role: secrets-reader
    scope: shop
    expires_at: 2026-10-06T20:04:31Z
scope "*" is the whole cluster; any other scope is one namespace.
› get_resource secret/db-credentials -n shop
apiVersion: v1
data:
  password: <redacted, 24 bytes>
  username: <redacted, 8 bytes>
kind: Secret
…
› delete_resource pod/web-7f9c-x2kq -n shop
agent.approval_pending: this write waits for a person's approval at
https://kubelatch.example.com/agents/requests/0199c1d2…; once approved,
call the tool again with the same arguments and approval_id 0199c1d2….
It expires at 2026-10-06T12:19:31Z
› approved by sergio, the same call with its approval_id
delete_resource: 200 OK (audit id 0199c1d3…)

It works as you, with only what you gave it: read-only unless you chose more.
Secret values stay hidden until it asks for them, and each read is recorded.
A change waits for a person, who sees the diff before it runs, once.

Connect it in one line

claude mcp add --transport http kubelatch https://kubelatch.example.com/mcp

The first time it uses kubelatch, your browser asks what it may do: your permissions, read-only by default, for 8 hours. Cursor and any MCP client connect the same way, and Claude Code has a plugin that also stops it reaching for kubectl.

// three ways

Three ways to give an agent access.

Three ways to give an agent access
Question	Your kubeconfig to the agent	Bot	Delegated
Who sets it up	You, at once	An administrator	You, at once
What the agent can do	Everything you can	What the administrator decides	What you can, cut down; read-only by default
What the audit shows	You	The bot	You, through the agent
How long it lasts	As long as your credential	Up to 90 days	Hours

The sessions table of the Agents page: six active sessions of Claude Code, Cursor and Codex CLI, on behalf of luis, marta and ana or as bots, each with its permissions, its expiry and its last use; one pending request. — Agents, in the web interface: every session, on whose behalf, with what, and until when. Cut ends it.

// bot or delegated

Two identities that never mix.

You're developer on shop. Your Claude Code, delegated, works as you, read-only. Meanwhile the on-call agent that reviews alerts at night uses the bot ops-agent, viewer on every namespace because an administrator granted it.

Bot or delegated
Question	Bot	Delegated
Who the agent is on the cluster	`bot:ops-agent`	`user:sergio`
Where its permissions come from	Those an administrator granted the bot	Yours, cut down by you
Who decides how much it can do	An administrator	You, up to your own limit
If a permission of yours is taken away	It doesn't affect it	The agent loses it at once

// how much it bothers you

Once per session, and only when it writes.

The browser opens once per session, like kubelatch login.
Read-only work asks nothing.
For a task with several changes, one approval of “developer on shop, 30 minutes” instead of one per change.

kubelatch states its limits: what an agent does through another way into the cluster, and what it does with what it reads. What it does not cover

Your agent on your clusters, without your kubeconfig

Two bad options.

Like “Sign in with Google”, for your clusters.

Add kubelatch once

Your browser opens

You choose, and authorize

It reads, it doesn't break

Changes wait for you

It ends by itself